In 2025, the Malta Gaming Authority sent mystery shoppers into dozens of licensed online casinos and tested their responsible gambling tools from the inside. The results revealed significant gaps between what operators promise on paper and what actually happens when a player tries to use a safety tool.
The Malta Gaming Authority is one of the world's largest gambling regulators, licensing hundreds of online casinos and sportsbooks globally. In the first half of 2025, the MGA ran a large-scale compliance sweep using mystery shoppers. These are trained assessors who pose as real players and test whether operators actually implement the safety tools they are legally required to provide. The audit was unannounced. Operators did not know they were being tested.
The MGA published its findings publicly. Four specific problems appeared across multiple platforms:
The MGA issued compliance remediation requirements for every operator that failed any assessment. Operators were given a defined period to fix the gaps. The MGA has enforcement powers to issue fines, suspend licenses, and in serious cases revoke licenses entirely. The publication of audit findings, even without naming individual operators, signals to the market that compliance surveillance is active and ongoing. Operators know they will be tested again.
MGA licensing does not guarantee every tool works perfectly every time. It does mean the regulator has the authority and demonstrated willingness to investigate failures and penalise operators. If you set a limit or request self-exclusion on an MGA-licensed site and the operator does not action it within a reasonable time, you have a documented right to file a complaint. The MGA operates a formal dispute resolution process and treats failure to implement safety tools as a serious breach. Set your limits at account registration rather than waiting for a crisis. Test your self-exclusion by attempting to log in after activation. If something does not work, document it and file a complaint with the MGA directly.
| Tool Tested | Regulatory Requirement | What the Audit Found |
|---|---|---|
| Self-Exclusion | Action the request promptly | Some operators applied excessive delays (48+ hours) |
| Cooling-Off Re-entry | Require manual re-activation | Some allowed automatic play resumption |
| Limit Prompts | Offer limits at registration | Multiple operators skipped this step |
| Identity Databases | Cross-reference exclusion lists accurately | Minor data variations allowed new accounts |
The MGA publishes executive summaries of compliance sweeps on its website. You can view anonymised enforcement actions and audit findings. Individual operator names are not typically disclosed in the report, but their remediation status becomes part of the public record.
The sweep tested a representative sample of MGA licensees. However, the findings apply to the entire licensed population as regulatory guidance. All MGA operators are now required to implement the same standards that failed in the audit.
Document everything. Take screenshots of your request and the timestamp. Contact the operator's support in writing (email preferred for a timestamped record). If they do not action it within 24-48 hours, file a complaint with the MGA. You can also escalate to the operator's alternative dispute resolution provider.
Verified against 0 primary sources. Last reviewed April 14, 2026.