Licensing and regulation: Can we get a licence?

Gaming law in Germany differs between states, though relevant legislation has been passed by way of an Interstate Treaty bringing some uniformity. In Germany, the relevant state treaties have been lined up since 2008, while the last one in its current form entered into force on 1 July 2021. Since then, the range of permissible games of chance has been expanded from sports betting and exceptions for lotteries and horse-race betting, which are of minor relevance to private operators, to virtual slot machine games and online poker. Online casino table games form an exemption, as these are subject to a numerical limitation, where online casino licences are only issued to a limited extent per state. The number varies between 0 and 5, depending on the number of casinos in the respective province (sec. 22c (1) No. 2 Interstate Treaty on Gambling 2021 - IST 2021). Gambling in Germany takes place both online and terrestrially. In the online sector, payment is made with non-anonymous means of payment; in the terrestrial sector, payment in cash is also possible. In principle, gambling is allowed, but is subject to varying degrees of restrictions to protect young people and addicts. The degree of restrictions depend on the degree of dangerousness to minors and addicts/players. As a result, slot machine games and poker games, both terrestrial and online, tend to be restricted more than sports betting and lotteries. Betting: By way of background, the centralised responsibility for the regulation of sports betting, as well as horse race betting, has been devolved to the Joint Gambling Authority in Saxony-Anhalt. Necessary documents and certificates that enable the authorities to assess the realms of permissible gambling include among other documents an excerpt from the register of companies, an excerpt from the Central Commercial Register in Germany, a certificate of Good Conduct / police record. Of particular importance is the subject of responsible gambling. This requirement is also reflected in different ways in the various concepts to be submitted. This includes an IT security concept (covering IT security and data protection), social concept (describing protection of minors and responsible gaming measures) or payment processing concept (which contains minimum requirements for payment processing, for example, an overview showing all deposit methods offered or an explanation regarding the prohibition of granting credit). In principle, the maximum deposit per month is EUR 1,000 (sec. 6 (1) 2 Interstate Treaty 2021). Deviating deposit option up to an amount of € 30,000 can be applied for. For this purpose, a forecast must be submitted containing percentage information on turnover and gaming stakes. If approved by the GGL, increased deposits require financial capacity from players. The operator is obliged to check these thoroughly. Furthermore, the operator has to carry out a comprehensive monitoring of players who have been granted an increased deposit limit. In addition, certain requirements are extremely difficult to meet. These include, for example, the insurance of players’ funds for EUR 5 million. This amount poses a particular challenge for small companies. The applicant needs to declare, in which way he wants to provide the security. Examples are bank guarantee, owner savings book, in this context special insurance policies required by the regulatory authority, are also difficult to obtain. Bingo: Under the current Interstate Treaty on Gambling, the offering of bingo is not licensable for private operators. Casino: The operation of land-based casinos in some states is reserved for the public authorities, other states provide a limited number of licences for private operators. The number of casinos allowed per state is, however, limited and will vary between the states. The Interstate Treaty 2021 provides for a monopoly of the states and/or of land-based casinos on operating live casinos and table games online, though the compliance of this restriction with EU law seems questionable. Separate from this are the regulations on slot machines, both in terrestrial offerings and in web-based form. These can be offered by private operators to the public and are not subject to a state monopoly or numerous clauses. Nevertheless, the general regulations of the Interstate Treaty 2021 must be taken into account. In addition, there are further restrictions on the game-related stakes, the maximum playing time, the permissible advertising, jackpot prohibitions and certain information and transparency obligations of the operators, as stipulated in the federal Gaming Ordinance (‘Spielverordnung’). Online Casino products, in particular so-called bank or table games e.g. roulette, black jack, baccarat or similar have become licensable nationwide with the new Interstate Treaty 2021. However, the number of licenses are limited to the number of terrestrial operations. Lottery: Lotteries are subject to a state monopoly, which means that the operation of lotteries is exclusively reserved for the state-owned lottery companies, which the German states are very protective of. With relation to lotteries, private operators may only apply for brokering licences, which allow them to sell lottery tickets on behalf of the state lottery companies. In respect of the general prohibition of operation and brokerage of online games of chance, lotteries are one of the exemptions made by the Interstate Treaty in this context. Poker: Online poker has become licensable for the first time after the Interstate Treaty on Gambling came into force on 1st July 2021. Consequently, private operators can now also offer poker on the internet. However, some restrictions apply that are both general in nature and special in character. Online poker is hence subject to a general monthly deposit limit of EUR 1,000 (A deviation from the monthly deposit limit of up to € 30,000 per month can also be applied for here since 1 January 2023. If an increased deposit limit has been approved and is to be granted to a player, the operator must check the financial capacity and - if the player has it - carry out extensive monitoring) as well as time limits that are supposed to interrupt the gaming session after 1 hour. Furthermore, operators must ensure that only natural persons play against each other and that they are only assigned to one table at a time. The table assignment must be carried out by means of audited random generators; the player himself must not be able to influence this. Simultaneous play of several poker games is prohibited. However, the authority responsible for issuing the licence may exceptionally permit simultaneous play at up to four virtual tables (sec. 22b (5) 2 Interstate Treaty 2021). Skill games: Skilled games are not subject to the scope of German gambling laws. German law consequently does not provide a licensing regime for the operation of skilled games. Software/B2B is not subject to the scope of the current Interstate Treaty on Gambling; the regulation neither requires nor stipulates a B2B licence. The Joint Gambling Authority (GGL) in Halle, Saxony Anhalt is managing all online licence application processes be it for online sports betting, online horse betting, online poker or virtual slot machine games. Only for online casino games (typical table and banker players) are the authorities of the federal states responsible. Thus, there is no national licensing process for online casino table games (as opposed to online slots – see casino product section) with each State deciding whether to grant licences to private operators or to have a state-owned or licenced monopoly. Period of licence & renewal process A licence is usually valid for 5 years. Renewals of licences are valid for 7 years, and so on. Application timeframe and phrases There are no deadlines to apply for gambling licences. However, a licensing procedure for online gambling permits for sports betting, virtual slot machines and online poker is an extensive administrative procedure, which in practice takes at least 9 months. Furthermore, and on a general basis, the competent authorities publish so-called application guidelines, which enumerate and summarise all necessary documents and contents for a sufficient application. Once the application has been submitted, ideally, the authority would then issue a licence based on the application. However, this period tends to usually be more onerous. The authorities will reach out to the operators approximately 2 to 4 times during this period with subsequent requests, meaning to clarify certain details within the application or to extend certain concepts and documents. In total, a licencing procedure can be pinned down to approximately 3 months of preparations, followed by submission and another 9-10 months of back and forth with the authorities, until a licence is issued. Documents & type of information needed to support application To obtain a licence, a number of conditions must be met. A peculiarity of licensing procedures in Germany is the requirement to submit so-called ‘concept’ documents (i.e., comprehensive descriptions of the gambling operation to be licensed that cover these aspects), such as: 1)an AML concept, including a risk assessment and AML policies and guidelines, 2)a payment processing concept, detailing the PSPs and adherence to regulatory requirements to payments methods to be made available to the customer, 3)a profitability concept, including a business plan for the licensing period, 4)an IT security concept covering IT security and data protection, 5)a social concept (sec. 6 Interstate Treaty on Gambling) describing protection of minors and responsible gaming measures, 6)a document laying out compliance with transparency requirements vis-à-vis the customer (also referred to as the ‘transparency concept’). With regard to the individual reliability of the applicant entity, the operator applying for a licence will have to provide evidence in the form of, for example, criminal records, CVs and qualifications of the relevant individual. There is no personal licensing requirement for key functions and managers though. Corporate entities may be considered unreliable if they have been fined for misconduct in business by public authorities, for example. In addition to the aforementioned concepts, economic and legally relevant information on the company must be provided. This includes a variety of comprehensive documents, including: 1)a presentation of the complete ownership and shareholder structure, disclosure of trustee relationships. 2)statement on how the financial security for a minimum 5 million EUR will be provided. 3)a copy of commercial registration in Germany. 4)a clearance certificate from the tax authority, excerpt from debtors’ register or an application letter, including a list of all authorised representatives and VAT ID. Applicant considerations Applicants need to be resident in the EU or EEA. Generally, the representatives or staff of online operators do not need to be German speaking except for the company’s AML Officer and Deputy AML Officer. ## Infrastructure Operators have to connect to several state-run servers and databases that intend to restrict a player’s behaviours in three ways: Firstly, operators need to integrate the nationwide player barring system (“OASIS”) which logs all banned players and helps avoid approaching, messaging, or allowing those banned players to participate in any form of gambling. Second and thirdly, the server system “LUGAS” contains two databases, the activity file and the limit fine. This monitors the activity and spending behaviour of players, ensuring that deposit limits are adhered to on a cross-operator level and that players don’t gamble for long periods without being forced to take breaks in between. As well as preventing simultaneous gambling on more than one operator’s website. ## Integrations As stated above, operators must connect to several state-run databases to ensure safer gambling and prevention of addiction. The integration with those servers is either an application requirement or, in the case of the player barring system, a licence requirement. Software certification Operators need to prove that their technical platforms are ISO 27001-certified. If they implement digital card payment methods, they need to submit PCI-certifications of such, too.