iGaming & Gambling Compliance in Austria

Austria's online casino and lottery market is closed to new entrants today; online sports betting is a separate, provincial matter. Under the Gambling Act (Glücksspielgesetz, GSpG), an online game of chance whose result is decided centrally counts as an electronic lottery. Only the holder of the single federal lottery licence may offer it. That holder is Österreichische Lotterien GmbH, through win2day.at. In 2024 the online channel earned EUR 213.2 million in gross gaming revenue, against EUR 304.5 million for the 12 land-based casinos.

The Tax Authority Austria (Finanzamt Österreich) supervises the licence holders. The Ministry of Finance makes gambling policy and law, and the Anti-Fraud Office (Amt für Betrugsbekämpfung) enforces against illegal gambling. Suspicious activity goes to the Federal Criminal Police Office's Financial Intelligence Unit (A-FIU).

The biggest obstacle for a new entrant is timing. Government bill 594 d.B. would create an open online licensing system, but it sits with Parliament's Finance Committee, and an EU notification standstill runs until 7 December 2026. Under the bill, anyone who has served Austrian players without a licence would have to stop from 1 January 2027 to stay eligible.

1. Who regulates this sector

The Financial Market Authority supervises banks and payment institutions, not gambling operators; the bill lists it among the authorities that would assist the Anti-Fraud Office.

2. Licensing and authorisation

Under § 3 GSpG, the right to run games of chance is reserved to the federal government. It is exercised through a small number of licences (Konzessionen). Under § 2(4), any game offered without a licence or permit is a prohibited game. The Ministry of Finance states that this applies equally online, and that a licence from another EU or EEA state gives no right to offer games in Austria.

Online today: electronic lotteries under one licence

§ 12a(1) GSpG defines electronic lotteries as games in which the player takes part directly through electronic media and the result is decided centrally. The Ministry treats online casino and poker offers as falling within this definition. Electronic lotteries are part of the single lottery licence under § 14. Applicants must:

• be a corporation with a supervisory board;
• have their seat in the EU or EEA;
• have at least EUR 109 million of paid-up capital, with its lawful origin proven;
• have controlling shareholders and managers who meet fit and proper tests.

Österreichische Lotterien GmbH holds it until 30 September 2027 (Ministry of Finance). Casinos Austria AG holds the casino licences under § 21, running until 31 December 2027 or 31 December 2030.

Land-based and provincial

Slot machines outside casinos are licensed by the provinces under § 5 GSpG. Classic sports betting is not gambling under the GSpG, because the Ministry treats it as mainly a game of skill. It needs a licence under the betting law of the relevant province instead. Bets on virtual or recorded events count as games of chance rather than sports bets; offered online, they are electronic lotteries.

The nine provincial betting laws differ on internet betting, identification and anti-money laundering triggers. Four of them (Lower Austria, Upper Austria, Salzburg and Tyrol) regulate internet betting. They treat the place from which the operator provides its data as the operating site, so a licence attaches to that location.

Proposed open online licensing [Bill, not enacted]

Government bill 594 d.B. reached the National Council (Nationalrat, the lower house of Parliament) on 5 August 2026. It was referred to the Finance Committee on 14 September 2026, which had not begun deliberations as of 11 November 2026; the committee's next meeting is set for 24 November 2026. The draft was notified to the European Commission on 4 August 2026 (notification 2026/0415/AT). The Commission issued comments and Malta a detailed opinion, which extended the standstill to 7 December 2026. Under the bill:

• A new § 13 would create an "online gambling" category, licensed in unlimited numbers.
• Online licences would need at least EUR 10 million of capital.
• An operator that has served Austria illegally must have stopped from 1 January 2027 and paid all outstanding gambling tax and player court judgments. If it stops later, it is barred for 18 months (24 months if it stops after 31 December 2029).
• Fees would be EUR 70,000 per application and EUR 300,000 for granting a first online licence (EUR 600,000 for each renewal).
• Online licences could be granted from 1 January 2027, taking effect from 1 October 2027.
• The existing lottery licence, including electronic lotteries, and six casino licences would be extended by law to 31 December 2028.

3. AML, KYC and customer due diligence

Gambling licence holders are not obliged entities under the Financial Markets Anti-Money Laundering Act (Finanzmarkt-Geldwäschegesetz, FM-GwG) directly. § 31c GSpG makes named FM-GwG provisions apply to them. Both the lottery licence holder (including online) and casino licence holders must:

• identify and record their money laundering, terrorist financing and sanctions-evasion risks under § 4 FM-GwG;
• apply the FM-GwG rules on simplified and enhanced due diligence and on high-risk third countries;
• apply the FM-GwG rules on politically exposed persons (PEPs), reporting and record keeping.

Casinos (§ 31c(2))

Identify every visitor at every visit, using an official photo ID shown in person. Apply full due diligence, including beneficial ownership, where cash and chip exchanges or stakes reach EUR 2,000 per visitor per gaming day. If a visitor appears to act for someone else, establish that person's identity, or refuse entry and inform the A-FIU.

Lotteries and online (§ 31c(3))

Apply customer identification, beneficial owner questions and enhanced measures only where the operator's risk analysis does not show a low risk. Identification may rely on a bank or other financial institution (§ 13 FM-GwG), but responsibility stays with the operator.

Where identification applies, § 6(2) FM-GwG requires an official photo ID issued by a state authority, with a non-replaceable photo, showing name, date of birth, signature and the issuing authority. Customers must say whether they act on their own account and name any beneficial owner (§ 6(3)).

Suspicious transactions must be reported to the A-FIU without delay (§ 16 FM-GwG). Licence holders must be able to tell the A-FIU or the supervisor, quickly and confidentially, whether they had a business relationship with a person in the past five years. Due diligence records and transaction records are kept for ten years after the relationship ends (§ 21 FM-GwG).

4. Identity verification and onboarding

Land-based rules are explicit:

• Casino entry is limited to adults aged 18 and over (§ 25(1) GSpG).
• Slot arcades need an access system admitting only adults (§ 5(4)(a)).
• Single slot machines need an identification system and a numbered player card showing name, date of birth and photo (§ 5(4)(b)).

For online play, the GSpG does not list accepted remote identification methods. It applies the FM-GwG identification duties to the lottery licence holder on a risk basis (§ 31c(3)), and does not import the remote-identification safeguards in § 6(4) FM-GwG. Those safeguards are:

• video identification;
• a statutory electronic ID;
• a qualified electronic signature, or registered post to the customer's stated residential or registered address, in each case with further conditions;
• a first payment from an account in the customer's name at a credit institution recognised under § 13 FM-GwG, with document copies or the bank's confirmation.

When they are used, the customer's name, date of birth and address must always be known.

The bill would make identity data central to online play:

• A new § 16(1a) would allow participation only from age 18.
• Operators would join an exclusion register (§ 31g) and an online supervision system with a deposit-limit register that holds player identification data (§ 31h).
• Operators would run a "safe server" recording every game in unalterable form (§ 31i).
• In casinos, showing a photo ID in person could be replaced by reliable technical recognition such as biometrics.

5. Digital channels: what's different

Bottom line: online casino games and lotteries are a monopoly product today. Land-based casinos must identify every visitor in person, while online identification follows the operator's risk analysis. The pending bill would bring online play up to, and in places beyond, land-based controls.

Risk-based identification online

Casinos must identify visitors "stets" (always). For lotteries and electronic lotteries, § 31c(3) GSpG requires identification only where the risk analysis "kein geringes Risiko ergibt" (does not show a low risk). The bill would apply this regime to the new online licences.

Blocking unlicensed offers [Bill, not enacted]

The Anti-Fraud Office would publish a blacklist with payment details such as IBANs. Payment service providers would have to stop processing payments to listed operators within three banking days of an order (§ 56e). Where orders against an operator's own service providers fail (§ 56c), the Telekom-Control-Kommission (Telecom Control Commission) could order internet access providers to block sites and redirect users to a warning page (§ 56d). Neither the current law nor the bill prescribes a geolocation method. The test is whether a game is offered for participation from Austria.

Product rules for online slots [Bill, not enacted]

Virtual slot machines would follow land-based slot rules: stakes of at most EUR 5 per game, at least 2 seconds per game, and a cooling-off break. Players would set their own limits, and raising a limit would take effect only after 72 hours.

6. Data protection and biometrics

The EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act govern identity capture. Biometric data processed to uniquely identify a person, such as facial images, is a special category whose processing is prohibited unless an exception in Article 9(2) GDPR applies.

The bill would give a statutory basis to further data uses:

• Biometric casino entry. Technical recognition, such as biometrics, could replace showing a photo ID in person.
• Registers. The exclusion register and the deposit-limit register would exchange player identification data between operators and the supervisor, under a Ministry regulation.
• Research data. Data passed on for research would be pseudonymised, keeping only sex and year of birth in clear.

7. Sector-specific obligations

Player protection and affordability

Under § 25(3) GSpG, a casino must act where it has reasonable grounds to think that an EU or EEA citizen's gambling endangers their subsistence minimum (Existenzminimum). It must obtain an independent credit report, hold a counselling conversation and ask about the player's finances. If the concern is confirmed or the player refuses, the casino must bar or limit their visits. A casino that fails to do this is liable for the losses that follow. Slot arcades apply this rule by analogy (§ 5(4)(a)).

The bill would extend player-protection monitoring, with civil liability, to all forms of gambling. This responds to the Constitutional Court's decision of 14 December 2022 (G 259/2022). Players aged 23 or over could have a higher deposit limit if they have sufficient creditworthiness and are monitored closely.

Advertising

Licence holders must keep a "responsible standard" in advertising (§ 56 GSpG). This is enforced only by the supervisor. The bill would set the standard out in a regulation.

Gambling tax

Games played from Austria are taxed at 17.5% of stakes. Electronic lotteries outside video lottery terminals are taxed at 45% of annual gross gaming revenue (§ 57(1) and (2)), at the rates that apply from 1 July 2025.

8. Risk indicators and red flags

Gambling typologies drawn from Austrian law and enforcement

• Third-party play: a visitor or account holder appears to act for someone else (§ 31c(2) GSpG).
• High-risk third countries: players linked to jurisdictions on the EU high-risk list (§ 31c(2) GSpG).
• Unlicensed payment routes: deposits to or from operators without an Austrian licence.
• Brand recycling: an applicant using a lightly changed brand of an illegal operator (concern addressed in the bill, § 14(2b)).
• Hidden machines: slot machines in non-gaming premises, with winnings paid in cash by a back-room operator.
• Subsistence risk: play intensity out of line with the player's income or assets (§ 25(3) GSpG).
• Low-risk play to clean cash: crime proceeds placed through a few low-risk casino bets, an example given by the A-FIU.

9. Enforcement and penalties

Offering prohibited games for participation from Austria is an administrative offence carrying fines of up to EUR 60,000 (§ 52(1) Z 1 GSpG). Where machines or other devices are involved, the fine is set per device (§ 52(2)):

• Up to three devices: EUR 1,000 to EUR 10,000 each, or EUR 3,000 to EUR 30,000 for repeat offences.
• More than three devices: EUR 3,000 to EUR 30,000 each, or EUR 6,000 to EUR 60,000 for repeat offences.

Organising games of chance for profit, or promoting a gathering held for them, is also a criminal offence under § 168 of the Criminal Code, punishable by up to six months' imprisonment or a fine of up to 360 daily rates.

AML breaches by licence holders carry fines of up to EUR 22,000 (§ 52b(1) GSpG). For serious, repeated or systematic breaches, the fine rises to EUR 1 million, or twice the benefit gained where that can be quantified (§ 52b(2)).

The Anti-Fraud Office reported about 13,500 inspections in the first half of 2026. Its recent published cases, such as five machines seized in Vienna in January 2026, concern land-based machines. The bill would raise the basic AML fine in § 52b(1) to EUR 60,000 and add fines of up to EUR 1 million for ignoring blocking orders.

On AML supervision, the FATF found casino supervision effective. Gambling and betting providers filed 20 suspicious transaction reports in 2025, according to the A-FIU.

10. Recent changes and what to watch

• 10 July 2027: the EU Anti-Money Laundering Regulation (EU) 2024/1624 applies. Gambling providers become obliged entities directly, with due diligence at stakes or winnings of EUR 2,000 or more (Article 19(5)). Member states may exempt state-regulated online gambling (Article 4) [Adopted, applies 10 Jul 2027].
• 1 January 2027: cut-off date for illegal online operators to stop serving Austria if they want to apply for a licence [Bill, not enacted]. Any later stop triggers an 18-month bar.
• 7 December 2026: extended end of the EU standstill on the bill, after Commission comments and a detailed opinion from Malta [Bill, not enacted]. The bill cannot be adopted before that date.
• 24 November 2026: next scheduled meeting of the Finance Committee, which received bill 594 d.B. on 14 September 2026 [Bill, not enacted].
• 30 April 2026: the FATF published Austria's mutual evaluation report (1 high, 2 substantial and 8 moderate effectiveness ratings) [Published].
• 1 January 2026: licence holders' sanctions-evasion risk assessment under § 31c GSpG widened from proliferation-related sanctions to all targeted financial sanctions (BGBl. I No. 151/2024) [In force].
• 1 July 2025: gambling tax rates changed, with electronic lotteries now at 45% of gross gaming revenue [In force].

11. What this means for identity verification

• Document standard. Where identification applies, use an official photo ID issued by a state authority, with a non-replaceable photo, name, date of birth, signature and issuing authority. Collect address too, which the FM-GwG remote methods require.
• Risk tiering. The risk analysis decides how far online identification goes. Document and keep it, because § 31c(3) makes customer identification depend on its outcome.
• Prepare for central checks. Design onboarding so that every registration and deposit can be checked in real time against a central exclusion register and a cross-operator deposit-limit register.
• Age data. Capture verified date of birth. The proposed limits change at ages 23 and 26.
• Biometrics. Biometric recognition would gain an express legal basis for casino entry. Online biometric matching needs a GDPR special-category legal basis.
• Retention. Keep identification evidence for ten years after the relationship ends.