Malta tested self-exclusion across 20 licensees and found gaps between brands

Self-exclusion works visibly when one account closes. The harder question is whether the same person can open or use another account under a sister brand, a slightly different identity record or a separate front end. Malta's regulator built its 2025 thematic review around that real-world problem.

The MGA mystery-shopped 58 active URLs operated by 20 B2C licensees. It tested exclusion activation, cross-brand account controls and the presentation of safer-gambling tools. The sample is broad enough to reveal patterns, but it is not a list of 58 independent companies.

The authority says most assessed licensees were broadly aligned with expectations. It also identified delays before exclusions became active, cases where exclusions were lifted without the mandatory cooling-off period, and difficulty detecting duplicate or closely matching identity information across brands.

The same exercise found absent prompts to set limits during registration and incomplete information in Reality Check pop-ups. Those are different control failures. One concerns who can play; another concerns what a player is asked or shown while playing.

People enter names, addresses and dates in inconsistent ways. Brands may use separate account systems, and a group can acquire platforms built on different technology. A literal exact match can miss the same person; an aggressive fuzzy match can block someone else.

That trade-off requires rules, human review and evidence. The goal is not to collect more personal data without limit. It is to use permitted identity data consistently enough that a self-exclusion choice is not defeated by spelling, formatting or brand architecture.

A control can activate promptly and still fail later if the account is reopened too easily. The MGA's cooling-off finding matters because a momentary request to return may occur during the risk period the exclusion was meant to create.

The public summary does not quantify how often this happened or identify the brands involved. It supports a thematic concern, not a claim that every tested operator restored excluded accounts improperly.

The authority sent findings to relevant licensees and asked for rectification plans. It says follow-up supervision will continue where necessary. No named fine, warning or licence suspension appears in the thematic announcement.

That status should survive into coverage. A remediation request can produce material operational change without becoming an enforcement sanction. If named decisions follow, they need their own documents and response records.

A strong programme needs near-real-time activation, group-level identity resolution, locked cooling-off logic and tests that prove every connected brand receives the status. Mystery shopping should be repeated after remediation rather than treating a policy update as evidence of effect.

Operators also need exception handling. When matching confidence is uncertain, staff need a route to investigate without allowing play to continue by default or retaining unnecessary data.

Testing should include ordinary variations: accents, compound surnames, changed addresses and account details entered in a different order. The purpose is not to create traps for staff. It is to find the predictable points where a group-level promise fails when real customer data is less tidy than a test record.

The next useful disclosure would report how many remediation actions were completed and whether retesting found the same gaps. Aggregate results could improve accountability without exposing individual players.

Until then, the measured conclusion is strong enough: Malta found generally positive practice and repeatable weaknesses across a multi-brand sample. Both halves belong in the headline file.