MGA publishes integrity review and finds operational gaps in betting oversight

The Malta Gaming Authority published an integrity review on 27 October 2026 that explains why low reporting volumes do not always indicate weak controls and that also identifies gaps in monitoring and escalation. The exercise covered B2C operators and B2B suppliers and took place between the second and fourth quarters of 2025.

Key findings

The review examined firms that had submitted few or no suspicious betting reports. The MGA found that low volumes often reflected conservative stake limits, restricted market selection and the removal of vulnerable events, including certain youth tournaments. The regulator noted that report totals alone are insufficient to measure risk management.

"Low reporting volumes reflected the underlying risk management processes and reliance on external monitoring, rather than a simple absence of detection capability." — Malta Gaming Authority

At the same time, reliance on external monitoring created gaps: many firms only opened internal investigations after an integrity partner issued an alert. Without that notice, suspicious activity was less likely to reach investigation or reporting.

The MGA requires real-time betting monitoring supported by human oversight. It also asks operators using sportsbook B2B suppliers to retain access to betting-level data so their own teams can assess concerns.

Reporting duties and written procedures

The review identifies six areas that require attention: reporting behaviour, monitoring, escalation, policies, athlete safeguards and relationships with integrity and sporting bodies. For compliance teams, the practical task starts with documenting the full route from detection to report submission.

The report emphasises that the responsibilities of the designated compliance function must be documented explicitly, together with the requirement to submit suspicious activity reports within the prescribed deadline. Written policies should reflect day-to-day operations and include staff training, decisions to suspend betting markets and periodic procedure reviews.

The MGA indicates that open communication with integrity monitors and data providers helps assess unusual bets; formal agreements can be helpful, though the regulator does not mandate them.

Reporting obligation across jurisdictions

For firms that operate in multiple jurisdictions, the review addresses a notification gap. Where suspicious activity involves players licensed by the MGA, information must reach the Maltese regulator even if the group first detected the pattern under another licence. The MGA noted that some companies only understood that obligation after regulator clarification.

The review also reminds firms that financial losses do not determine the obligation to report: licensees must submit relevant concerns within the required timescale even if there is no financial harm.

Methodology and consequences

The work was carried out between Q2 and Q4 2025, with a risk-based sample of B2C operators and B2B suppliers. The MGA used supervisory meetings, reviews, company documents and follow-up clarifications to form its findings. The authority described the exercise in its February 2025 supervisory plan and used its Suspicious Betting Reporting Mechanism to identify businesses with little or no reporting.

The MGA published aggregated and anonymised findings without naming participants or disclosing the sample size. The authority plans to use the results in future guidance and supervision and warned in its 2025 plan that serious failings could lead to enforcement action.

Miguel Sandoval, Corresponsal de regulación.