Suppliers are no longer exempt from regulatory fire

The regulatory net is widening beyond operators, and now the entire supply chain is in the crosshairs, says BetComply chief compliance officer Mike de Graaff

For years, our industry has held a quiet assumption that enforcement is an operator problem, not a supplier one.

Fines and the threat of licence revocation all land on the operator. Suppliers build the tools, take their share of revenue, and watch from a safe distance.

But that assumption is now being dismantled

The direction of travel, particularly across Europe over the last twelve months, is clear. Regulators are extending their reach further up the supply chain.

When the Dutch regulator Kansspelautoriteit (KSA) set out its 2026 regulatory agenda at the start of the year, it was explicit in its plans to increase oversight to the entire ecosystem, not just unlicensed operators.

Payment providers, hosting companies, social media platforms, and B2B suppliers were all named. "The illegal market is more than just illegal gambling websites."

Meanwhile, the Swedish Gambling Authority (SGA) issued warnings and fines to three studios last September for a range of breaches after titles were found on unlicensed websites.

The fines were not particularly hefty, with the highest amounting to SEK650,000 (€58,800), in part because games were either quickly removed or were on unlicensed sites via third-party partners.

But the SGA did note that suppliers are responsible for preventing their software from reaching the black market, and that future violations could result in fines of up to 10% of turnover and even licence revocation.

And in December, Romania introduced new laws that tightened obligations on B2B providers, including platform and games studios, that force them to proactively block access when Romanian players are accessing their products via unlicensed operators.

Enforcement is climbing the chain

Don’t get me wrong, direct enforcement actions against pure B2B software providers remain the exception, not the norm. Most European regulators still primarily target operators.

But the trajectory is changing, and suppliers do need to adapt. Here is what that actually means in practice.

Turning a blind eye is no longer an option. The era of distributing content to all and any third-party platform or aggregator and assuming immunity from enforcement is ending.

Regulators are making clear that the supply chain is not a responsibility-free zone. Knowing your content ended up on an unlicensed site via a partner does not insulate you, particularly where your licence conditions require you to take reasonable steps to prevent exactly that outcome.

Be selective about who you work with. Due diligence on distribution partners needs to be substantive, not box-ticking. Which markets are your aggregator partners active in? Which operators are they supplying? Do those operators hold the appropriate licences?

These are questions suppliers need to be able to answer. The Swedish cases are instructive here. Studios that moved quickly and could demonstrate proactive engagement with the regulator fared better than those that could not. Regulators want to see evidence of effort, not just contractual clauses shifting responsibility downstream.

Engage closely with your partners. The SGA and KSA are not the only regulators signalling that they want to see active involvement from B2B providers in policing the ecosystem.

Across Europe, the expectation is increasingly that suppliers maintain visibility over where their products are distributed and take an active role when problems arise. Close working relationships with operator and aggregator partners are what regulators want to see.

And this is not only about unlicensed distribution. There is also a broader shift in how products interact with regulation from the ground up. Are your games designed with responsible gambling obligations in mind? Do they support the technical requirements that differ from jurisdiction to jurisdiction?

Suppliers who build to the lowest common denominator and leave compliance customisation entirely to the operators are increasingly out of step with where regulation is heading.

The expectation is growing that compliance is built into the product, not bolted on afterwards. That is not just the operator's problem to solve.

In short, it is no longer possible to stand on the regulatory sidelines.

Now is the time to review your distribution agreements, map your exposure across the jurisdictions your content touches, and ask hard questions about the partners you work with.

Because the assumption that kept much of the B2B world comfortable for years is no longer one you can rely on.