The Dutch KSA Renews Eight Online Licences and Weighs Five Years of Breaches

TOTO, Holland Casino, Kansino, FairPlay, Bingoal, bet365, GG Poker and Betcity have licences to September 2031. For the first time the regulator explicitly examined violations definitively established in the previous five years, asked applicants what they had done about them, and issued unnamed operators "additional points for attention".

• The Kansspelautoriteit has granted the first eight follow-on licences for online gambling, effective from October 2026 to September 2031, according to its statement of 17 September
• The holders are TOTO Online B.V. (TOTO and Winnitt), Holland Casino N.V. (Holland Casino Online), Play North Limited (Kansino), FPO Nederland B.V. (FairPlay Casino), Bingoal Nederland B.V. (Bingoal), Hillside (New Media Malta) Plc (bet365), NSUS Malta Limited (GG Poker) and Betent B.V. (Betcity)
• New in the follow-on process: the regulator explicitly examines violations definitively established over the past five years, and applicants had to explain what they did to remedy them and to prevent recurrence
• On that assessment the KSA gave several operators "additional points for attention"; it did not say which operators or what the points were, and confirmed all eight met the requirements
• The first Dutch online licences were issued when the market opened on 1 October 2021 and expire on 30 September; the KSA revised its remote gambling licensing rules from 1 January 2026

The First Regulator to Renew a Whole Cohort Has a Compliance File to Read

The Netherlands has reached the end of its first full online licensing cycle, and its regulator has used the renewals to look backwards. The Kansspelautoriteit (KSA) announced on 17 September that it had granted the first eight follow-on licences, running from October 2026 to September 2031, to the operators whose original permits expire on 30 September, five years after the market opened on 1 October 2021.

The eight are TOTO Online B.V., which runs TOTO and Winnitt; Holland Casino N.V. for Holland Casino Online; Play North Limited, which operates Kansino; FPO Nederland B.V. for FairPlay Casino; Bingoal Nederland B.V.; Hillside (New Media Malta) Plc for bet365; NSUS Malta Limited for GG Poker; and Betent B.V. for Betcity. The list mixes the two state-linked incumbents, the Dutch land-based names that moved online, and the international operators that entered at launch.

The process differed from the original applications in one respect the KSA highlighted itself. In assessing a follow-on licence, the regulator said, it also looks explicitly at the violations that have been definitively established in the past five years. Applicants had to explain what measures they had taken to remedy those breaches and to prevent them being repeated. On the basis of that assessment, the KSA gave several operators "additional points for attention". It did not identify which operators received them or what they concerned, and confirmed that all eight satisfied the requirements for a new licence.

That five-year record is not a light one. The Dutch market has produced some of Europe's largest online penalties, and the KSA revised its remote gambling licensing rules with effect from 1 January 2026 after a period in which it tightened advertising restrictions, deposit limits and duty-of-care obligations. Its chairman said this month that half of every euro staked now goes to illegal operators, and the government has raised gambling tax in stages.

A Renewal Regime Is the Enforcement Tool Regulators Have Been Missing

A fine is a cost of doing business and a licence is an asset. Until this month, an operator's breach record in the Netherlands was a series of separate penalties, each concluded and paid; now it is an input to whether it may keep trading, and the applicant must argue its own case in writing. That changes the calculus on whether to contest a small sanction, because a definitively established violation becomes evidence at renewal. Other European regulators issue licences that renew, and few have publicly shown a compliance history determining an outcome. The KSA has just told its market that it does.

"Additional Points for Attention", Unattributed, Is a Warning Nobody Can Learn From

The KSA's decision to say that several operators received observations without saying which or what is the same anonymity problem France ran into this week with its first sanctions case. It protects the operators concerned and it gives the other licensees nothing to act on. A regulator that wants the cohort to improve has to publish what the improvement is, or the exercise remains a private conversation with a public headline. The counter-argument is that a renewal is not a sanction, and that naming would turn an administrative observation into a de facto penalty without a right of appeal.

Eight Is the Beginning, and the Interesting Decisions Are the Ones Still Pending

More than twenty operators have held Dutch online licences, and the KSA has published eight renewals two weeks before the old permits lapse. Whoever is not on the list is either still being assessed or is not coming back, and by 1 October the market will know which. For an operator, a renewal refused is an exit from a market it has spent five years and considerable marketing money building; for the KSA, refusing one would be the first real test of whether the compliance file it has just started reading can carry that weight.

The Netherlands has turned five years of enforcement into a condition of continuing to trade. Every regulator with a renewable licence will be watching what it does with the applications it has not yet decided.