iGaming & Gambling Compliance in Germany

Germany is an open but tightly regulated online market. Since the Interstate Treaty on Gambling 2021 took effect on 1 July 2021, private operators can obtain nationwide licences for sports betting, virtual slot games and online poker, while online casino table games remain a matter for each state.

The Gemeinsame Glücksspielbehörde der Länder (GGL) in Halle (Saale) licenses and supervises most online products and is also their anti-money laundering supervisor. The Financial Intelligence Unit receives suspicious activity reports, and Hesse runs the national self-exclusion system.

The biggest obstacle for a new entrant is the volume of real-time, player-level controls that must be built before launch: identity, exclusion, deposit-limit and parallel-play checks against central state systems, plus a EUR 5 million bank guarantee.

1. Who regulates this sector

Gambling law is state law; anti-money laundering law and gambling taxes are federal.

2. Licensing and authorisation

Public gambling may only be organised or brokered with a licence from the competent authority, and taking part in payments for unlicensed gambling is itself prohibited (§ 4(1) Glücksspielstaatsvertrag 2021, GlüStV 2021). Online licences exist only for lotteries, sports and horse betting, online casino games, virtual slot games and online poker (§ 4(4)).

Nationwide online licences

The GGL grants licences valid for all states for online sports betting intermediation, sports betting, online poker and virtual slot games, and online horse betting (§ 9a(1) No 3 and § 27f(1) GlüStV 2021). A first licence runs for five years, later licences for seven (§ 4c(1)). Applicants must disclose every holder of more than 5% of capital or votes, show the lawful origin of funds, have an EU or EEA seat (with a German representative if based abroad) and give the regulator real-time interfaces to all games (§ 4a(1)). A security of EUR 5 million in the form of an EU or EEA bank guarantee is required, which the GGL can raise to one month's expected turnover, up to EUR 50 million (§ 4c(3)).

Online casino games and land-based gambling

Online casino table games are not licensed by the GGL. Each state may run them itself or grant a limited number of concessions, no more than its number of land-based casino concessions, valid only for its own territory (§ 22c). On the whitelist of 2 October 2026, only Schleswig-Holstein (four licensees) and Bavaria (one offer) permit online casino table games. Land-based casinos, arcades and betting shops are licensed under state law.

Domain, whitelist and tax

Licensed online offers must run on a .de domain and state on the home page that under-18s may not play and which authority supervises the operator (§ 6e(3)). Licensed operators appear on the official whitelist (§ 9(8)): 129 operators and intermediaries with 229 websites in September 2026. Sports betting, virtual slot games and online poker each carry a federal tax of 5.3% of stakes when the player places the bet or game from Germany (§§ 16, 18, 36, 38, 46 and 48 Rennwett- und Lotteriegesetz). Recreational players' winnings are not taxed, but a professional online poker player's winnings can be business income (BFH, X R 8/21, 22 February 2023).

3. AML, KYC and customer due diligence

Organisers and intermediaries of gambling are obliged entities under § 2(1) No 15 Geldwäschegesetz (GwG, Anti-Money Laundering Act, as last amended on 29 June 2026). Operators of gaming machines under § 33c of the Trade Regulation Act, totalisator associations and licensed lotteries are excluded. The GGL supervises its licensees for AML purposes, state authorities the rest (§ 50 No 8 GwG).

When CDD applies

Online: always, with no threshold (§ 16(1) GwG). Land-based: for stakes or winnings of EUR 2,000 or more, or by identifying every player on entry and tracing transactions of that size to the player (§ 10(5)).

What CDD covers

Identifying the player and any person acting for them, purpose of the relationship, checking for politically exposed persons (PEPs) and ongoing monitoring (§ 10(1)). If CDD cannot be completed, the relationship must not start or must be ended (§ 10(9)).

Enhanced due diligence

Required for PEPs, high-risk third countries and unusually large, complex or purposeless transactions (§ 15(3)), with senior management approval and steps to establish the source of funds (§ 15(4)).

Governance

A risk analysis (§ 5), and an AML officer at management level with a deputy (§ 7(1)). Every obliged entity must register electronically with the FIU, whether or not it ever files (§ 45(1)).

Suspicious matters must be reported to the FIU without delay and regardless of amount (§ 43(1)). A reported transaction may only proceed with FIU or prosecutor consent or once the third working day after sending has passed without a stop (§ 46(1)), and tipping off is prohibited (§ 47). CDD records are kept for five years and destroyed after ten years at the latest (§ 8(4)). EU financial sanctions regulations apply directly in Germany, and the Bundesbank's Servicezentrum Finanzsanktionen is responsible for implementing financial sanctions.

The state supervisors' joint guidance "AuA GwG Glücksspiel" (November 2020), which the GGL still lists as the current guidance and expects to update in 2026, treats payouts to an account other than the staking account as higher risk and requires documentary evidence of source of funds, such as bank statements or payslips (sections 4.3.1.2 and 4.3.1.3).

4. Identity verification and onboarding

Online operators must open one player account per player, and play without an account is not allowed (§ 6a(1) GlüStV 2021). At registration the player gives first name, surname, birth name, date and place of birth and residence; the operator must check these "by suitable and reliable procedures", and the licence can name specific procedures (§ 6a(2)).

Verification timing

No play and no payouts are allowed before the data are confirmed, with one exception: for 72 hours after registration the player may play with deposits of up to EUR 100, after being told, and acknowledging, that nothing can be withdrawn until verification is complete (§ 6a(4)).

Accepted methods

The GwG lists the means of verifying a natural person: a valid official photo ID, the German online ID function (eID), a qualified electronic signature combined with a payment from an account in the customer's name, an eIDAS-notified eID scheme, or specified payment-account documents (§ 12(1)). Other procedures are allowed only if their security level equals an on-site document check (§ 13(1)). The state supervisors' guidance accepts video identification on that basis if it meets every requirement of BaFin circular 3/2017, and rules out non-official documents such as utility bills or bank statements (AuA GwG Glücksspiel, section 4.1.3.1.4). BaFin confirmed in July 2025 that the circular still applies. A draft video identification ordinance (GwVideoIdentV, 18 April 2024) [Draft, not adopted] had not been promulgated as of October 2026.

What the GGL expects in a licence application

The GGL's application leaflets for sports betting, virtual slot games and online poker (June 2026) require a description of an identification and authentication solution that follows the youth media protection commission's (KJM) criteria, including the OASIS check. Under the KJM criteria for age verification systems ("AVS-Raster", valid since 12 May 2022), the one-time identification is in principle a face-to-face check against an official ID, for example at a post office. Alternatives are reliance on an earlier face-to-face check (such as compliant bank onboarding or the eID), video identification with BaFin circular 3/2017 safeguards, or software matching the ID photo to the person and reading the document data automatically. ID copies are not enough, and authentication is needed every session. The leaflets also ask for nationality at registration, a strong password (or biometrics or two-factor authentication), a lock after five failed logins, logging of the player's IP address at registration, and measures against VPN circumvention of geographic restrictions; the safe server must also hold data showing the licence's territorial scope is respected (§ 6i(2)).

Age, exclusion and authentication

Under-18s may not play (§ 4(3) GlüStV 2021). Minors and blocked players must be excluded at all times by suitable technical identification and authentication, (§ 6e(1)).

5. Digital channels: what's different

Bottom line: online play triggers full identification of every player before real play or payout, plus real-time checks against three central state files, while land-based venues identify players only for exclusion checks and from EUR 2,000 for anti-money laundering purposes.

Central state files checked in real time

Before each deposit the operator queries the limit file and must refuse a deposit that would exceed the monthly limit; increases apply after seven days (§ 6c(3), (6) GlüStV 2021). Before the first game it flags the player as active in a second file and may not admit a player already active elsewhere (§ 6h(3), (4)). The OASIS blocking check is carried out at the same moment, after technical identification (§ 8(3)).

Payment controls

Deposits and payouts must use a payment account in the player's name at a bank or payment institution that is itself an obliged entity under § 2(1) No 1 or 3 GwG; anonymous means are prohibited (§ 6b(4) GlüStV 2021; § 16(4), (7) GwG), with a GwG exception up to EUR 25 per transaction and EUR 100 a month. New payment details trigger re-verification (§ 6a(6) GlüStV 2021).

6. Data protection and biometrics

The GDPR and the Federal Data Protection Act apply to identity capture. The treaty fixes its own retention rules: OASIS entries may include photographs and are deleted six years after a block ends (§ 23), limit-file data are deleted after one year of inactivity (§ 6c(8)), and safe-server data are pseudonymised (§ 6i(2)). Anti-money laundering records, including ID copies and video recordings, are kept for five years (§ 8(4) GwG).

German data protection authorities treat biometric matching for unique identification as prohibited in principle under Article 9(1) GDPR unless an exception applies, typically explicit consent referring expressly to the biometric data (Datenschutzkonferenz position paper, 3 April 2019, adopted against the votes of Bavaria and Baden-Württemberg).

7. Sector-specific obligations

Affordability and higher deposit limits

The cross-operator limit may exceed EUR 1,000 only under the GGL decision guideline: up to EUR 10,000 a month if the player proves matching financial capacity with verifiable documents such as tax assessments or bank statements (self-declaration is not enough), repeated at least yearly, with special monitoring; up to EUR 30,000 for players aged 21 or over, for no more than 1% of an operator's active players. Limits above EUR 30,000 are not allowed. The guideline permits such limits until 31 December 2026 at the latest. No check method is prescribed; reliance on credit-agency reports is legally contested.

Virtual slot game controls

Virtual slot games are limited to EUR 1 per spin, at least five seconds per game, no autoplay, no jackpots and one game at a time (§ 22a GlüStV 2021). A GGL guideline of 1 July 2026 allows stakes up to EUR 3 for players aged 21 or over and up to EUR 5 after a 90-day period without risky play under special monitoring, until 31 December 2027.

Player protection systems

Operators of sports betting, online casino, poker and virtual slot games must run an algorithm-based early detection system for problem gambling and display a "panic button" that triggers an immediate 24-hour block without confirmation (§ 6i(1) and (3)). Operators must block players who request it or show signs of addiction, for at least one year (§ 8a).

Prediction markets

Bets on social, political or economic events cannot be licensed; an offer that effectively excludes players in Germany is not, by itself, illegal gambling there (GGL, 13 August 2026).

8. Risk indicators and red flags

Gambling typologies from the German supervisors

• Pass-through: funds deposited and withdrawn with little or no play.
• Multiple or nominee accounts: slight name variations, straw players, shared payout accounts.
• Multi-channel structuring: splitting stakes across online, shop and direct bets to stay under thresholds.
• Loss-limited betting: covering both outcomes, or very large stakes at odds such as 1.01.
• Collusion: chip dumping in player-versus-player games, insider staff or match fixing.
• Payout to a different account from the one used for stakes.

Source: AuA GwG Glücksspiel, sections 2.4 and 4.3.1.

9. Enforcement and penalties

Breaches of the GlüStV 2021, including unlicensed online gambling, letting minors play, payment participation and advertising breaches, are administrative offences with fines of up to EUR 500,000 per offence (§ 28a(2)). The GGL can publish warnings against licensees and revoke licences (§ 4d(4)); it reported two revocations by September 2026. Unlicensed gambling is a criminal offence under § 284 of the Criminal Code: up to two years' imprisonment or a fine, three months to five years if commercial or by a gang, and up to one year for advertising it.

Under § 56 GwG, fines reach EUR 100,000 (EUR 150,000 for intent), and for serious, repeated or systematic breaches up to EUR 1 million or twice the economic benefit.

Against illegal operators, the GGL may order payment service providers to stop processing payments (§ 9(1) No 4) and order blocking measures against responsible service providers such as access providers (§ 9(1) No 5); the second amending treaty will extend No 5 to all intermediary services under the EU Digital Services Act, including mere conduit. In 2025, 1,843 illegal websites were made unreachable from Germany. The Higher Administrative Court of Saxony-Anhalt held in interim proceedings that the payment-blocking power is compatible with the freedom to pursue an occupation (decision of 26 October 2023, 3 M 72/23).

10. Recent changes and what to watch

• 10 July 2027[Adopted, applies 10 Jul 2027] EU AML Regulation (EU) 2024/1624: gambling providers are obliged entities, with exemptions barred for casinos and for online gambling or betting businesses unless state-operated or state-regulated; EUR 2,000 CDD trigger; eID at eIDAS "substantial" or "high" recognised. The GwG must be adapted.
• 2027[Licence renewals] The GGL is preparing a new licensing cycle from 2027.
• 31 December 2026[Evaluation report due] Summary evaluation report on the GlüStV 2021 due (§ 32).
• 31 December 2026[Time-limited guideline] End date of the GGL guideline allowing monthly deposit limits above EUR 1,000.
• 9 September 2026[Adopted, effective date not yet set] Second amending treaty, published in Hesse on 9 September 2026: OASIS checks only through the access ID assigned to the venue or domain, and blocking orders against all EU Digital Services Act intermediaries. In force the day after the last ratification is deposited.
• 13 August 2026[In force] GGL guidance confirms social, political and economic event betting, including prediction markets, cannot be licensed.
• 1 July 2026[Optional relief until 31 Dec 2027] GGL guideline allowing virtual slot stakes above EUR 1 for players aged 21 or over.

11. What this means for identity verification

• Timing: full verification within 72 hours of registration, and no withdrawal before it.
• Data set: capture birth name and place of birth; they feed the OASIS, limit and activity files.
• Methods: use a KJM-compliant identification route (eID, reliance on bank onboarding, video identification to the BaFin standard, or automated ID-to-selfie matching); ID copies and utility bills do not count.
• Re-verification: at least yearly, and on any change of payment details.
• Evidence: keep ID copies, eID identifiers and full video-ident recordings for five years, and obtain explicit consent for biometric matching.