The Court of Justice of the European Union has delivered a brutal blow to the cross-border online casino model. In Case C-440/23, European Lotto and Betting and Deutsche Lotto- und Sportwetten, the CJEU ruled on 16 April 2026 that EU law does not stop a Member State from banning certain online gambling services even when the operator is licensed in another EU country such as Malta. Worse for the casino industry, the Court also confirmed that those illegal offers may carry civil-law consequences: the gambling contract may be treated as void, and players may sue to recover their losses under national law. For the Malta casino crowd, this is more than a legal setback. It is a crack in the business model.
Key Findings
- The CJEU held that EU law does not preclude a Member State from prohibiting certain online gambling services that are licensed in another Member State.
- The Court said such prohibitions may legitimately pursue consumer protection, prevention of gambling addiction, protection of social order, and channeling gambling into controlled circuits.
- The judgment confirms that a later shift to a licensing model, such as Germany’s 1 July 2021 reform, does not retroactively wipe out the earlier prohibition.
- The Court also held that EU law does not preclude nullity of the gambling contract and civil restitution claims for losses incurred under the prohibited regime.
- The reference arose from a dispute involving Malta-licensed operators whose services were accessible in Germany, where a player incurred losses between June 2019 and July 2021 and sought recovery.
Compliance Analysis
The Malta excuse just took a hit
For years, the offshore casino pitch was simple: we are licensed in Malta, we are in the EU, therefore we are legitimate. That line has now taken a serious beating.
In C-440/23, the CJEU made clear that a gambling licence in one Member State does not act like an EU passport for online casinos targeting consumers in more restrictive jurisdictions. Gambling remains an area without full EU harmonization, and Member States still have broad room to decide how far they want to go in restricting online casino products.
That is the core message: Malta licensing does not neutralize German law, or any other national law that validly bans the product.
What the case was really about
The case involved European Lotto and Betting Ltd and Deutsche Lotto- und Sportwetten Ltd, two companies licensed by the Malta Gaming Authority. Their online services were available in Germany. Between June 2019 and July 2021, a Germany-based player used those services and lost money. During that period, German law still broadly prohibited certain online games of chance, including the products at issue in the case, before the later reform that took effect on 1 July 2021.
The player’s claim ended up before a Maltese court, which asked the CJEU whether EU law — especially the freedom to provide services — blocked Germany from maintaining that prohibition and from attaching civil consequences to it. The Court’s answer was effectively: No. It does not.
The Court did not blink
The judges accepted the standard anti-gambling arguments that regulators love and operators hate: online gambling can create particular risks because it is available continuously, takes place in isolation, reduces social control, may encourage excessive frequency of play, and can be especially dangerous for vulnerable persons and younger users. On that basis, the Court said Member States can try to channel gambling into supervised structures and suppress parallel markets.
That matters because it kills the lazy narrative that national restrictions are automatically protectionist or anti-single-market nonsense. The Court did not buy that.
The real bomb: players may sue for the money back
This is the part that will terrify the illegal-casino ecosystem.
The CJEU expressly said EU law does not preclude national rules under which gambling contracts concluded in breach of the prohibition are void, and under which players may bring civil actions to recover lost stakes. The final mechanics still depend on national law, of course. But the big EU-law umbrella defense has been badly damaged.
That means operators can no longer wave the EU flag and pretend that player restitution cases are obviously incompatible with the single market. The Court just made clear they are not.
The German reform did not save the old conduct
One of the casino industry’s favorite talking points has been that Germany moved to a regulated licensing regime on 1 July 2021, so the earlier prohibition must have been defective, obsolete, or incompatible with EU law. The CJEU rejected that shortcut. A later policy change does not automatically invalidate the earlier ban.
That is devastating for operators facing claims tied to the pre-July-2021 period. They cannot simply say: Germany later legalized parts of online gambling, therefore our earlier German-facing operations were fine all along. The Court did not give them that escape route.
What this means for players at illegal casinos
Players should not misunderstand the ruling. This is not an automatic jackpot. The Court did not say every player in every EU country automatically gets every euro back. What it did say is far more useful in practice: where a Member State validly prohibited the gambling offer, and where national law allows nullity and restitution, EU law does not stand in the way.
That is a strong pro-player result. It strengthens claims by players who lost money with operators targeting them during periods when the relevant products were prohibited in their home market. It also weakens the industry line that the player’s mere use of a foreign-licensed site is enough to label the claim abusive. The Court indicated that foreign licensing alone is not enough to prove abuse of rights under EU law.
In plain English: players at illegal casinos now have a clearer EU-law runway to sue for restitution, if their national law supports it.
Why this matters beyond the operators
This ruling is bad news not just for the casinos themselves, but for the entire support system around them.
If the underlying gambling offer can be treated as unlawful and the contract can be voided, then the legal and compliance heat rises for everyone riding that traffic: payment processors, open-banking providers, affiliate networks, merchant acquirers, payment agents, KYC vendors, and platform intermediaries. That broader implication is an inference rather than an express holding of the Court, but it follows naturally from the Court’s acceptance that illegal online gambling can produce real civil-law fallout.
For FinTelegram’s long-running work on illegal casinos and payment rails, this is exactly the point. Once the operator’s legal footing weakens, the payment chain starts to look much more dangerous too.
FinTelegram Take
This is a serious defeat for the Malta casino defense industry.
The CJEU did not abolish cross-border online gambling. But it did demolish the lazy fiction that a Malta licence magically disinfects gambling offers aimed at consumers in restricted markets. It also handed players and claimant lawyers a much stronger weapon: EU law is no longer the easy shield operators hoped it would be when players sue for losses from illegal offers.
For years, the offshore gambling crowd sold the same line to PSPs, banks, service providers, and maybe even themselves: licensed in Malta, therefore legitimate in Europe. The Court has now reminded them that Europe does not work that way. National gambling law still bites. And when it bites, it can bite hard.
Conclusion
The ruling in C-440/23 is one of the most important recent judgments in the EU online gambling fight. It confirms that Member States may ban certain online casino and gambling products despite foreign EU licences, may preserve the civil effects of those bans, and may allow players to pursue recovery of losses under national law. For illegal-casino operators, this is a warning shot. For players, it is an opening. For the payment and compliance ecosystem surrounding offshore gambling, it is a message that the risk perimeter around illegal casino flows has just expanded.
If you have internal documents, legal memos, payment-routing files, merchant onboarding records, or compliance reports relating to illegal EU-facing online casinos, send them securely to Whistle42.
