C-440/23: Europe's gambling ruling has a winner nobody is talking about

Roman Baranovskyi, Senior Lawyer, Head of iGaming and Investment Practice, SBSB FinTech Lawyers

Last month, Europe's highest court issued its judgment in Case C-440/23 a ruling the gambling industry has been nervously waiting for. The headline version: operators running online casinos without a local license in EU countries must now pay back players' losses. Full stop.

The industry reaction split along predictable lines: Malta panicked, offshore operators declared it someone else's problem, and consumer advocates celebrated a hard-won victory. Everyone missed the bigger story.

How a single ruling became an EU-wide legal principle

For years, online gambling operated on a convenient fiction: get a license in Malta, and you're effectively licensed across Europe. The Malta Gaming Authority (MGA) was reputable, the island was an EU member state, and operators used this to serve German, Austrian, and Dutch players without going through the expensive and slow process of getting a local license in each country. At its peak, Malta hosted over 300 licensed gambling companies, making it the de facto regulatory hub for a European online gambling market that reached €47.9 billion in revenue in 2024, according to the European Gaming and Betting Association.

European courts had been pushing back on this for years. Germany and Austria in particular started ruling that contracts between unlicensed operators and local players were simply void — meaning players could sue to recover not just recent losses, but everything going back years.

The April 2026 ruling in Case C-440/23 (European Lotto and Betting and Deutsche Lotto und Sportwetten) took this from a national court trend to an EU-wide legal principle. The message from Europe's top judges: a license from Malta — or anywhere else — does not give you the right to operate in another EU country. Each country decides for itself what's legal on its territory. And if you operate there without permission, your players can come after you for every euro they lost.

The real beneficiaries are not the players

What the consumer protection framing misses is a straightforward question of competitive advantage.

The operators facing huge liability from this ruling are not the big names you'd recognize. The major players — the ones with household names and stock market listings — already hold local licenses in every significant European market. They spent years and tens of millions building that compliance infrastructure, while smaller offshore competitors skipped that cost and served the same players anyway. In Austria alone, mass litigation against offshore operators has been running since 2020. Litigation funders have been aggregating thousands of individual claims, covering losses going back up to 30 years under Austrian law.

This ruling doesn't hurt the big operators. For smaller operators who built their European business on an offshore license, it fundamentally changes the risk calculus. Italy showed us exactly where this ends up: a November 2025 licensing reform there compressed a market of over 400 active gambling domains down to just 52 licensed operators, with each license priced at €7 million for a nine-year term, according to Italy's gambling authority ADM — effectively designed to hand market control to well-capitalized incumbents. C-440/23 achieves the same outcome through a different mechanism — not by raising the cost of entry, but by making the cost of staying outside the system existential.

Why "We're not Malta" is not a defense

After the ruling, operators licensed in other offshore jurisdictions — Curaçao, Anjouan, and others — mostly shrugged: Malta's argument was specific to EU passporting, they said, and since they never made that claim, they considered themselves safe. They are not.

The court's logic doesn't depend on which argument an operator was making. It depends on a simple question: does this operator hold a license that is valid under the law of the country where the player lives? If the answer is no, the contract is void and the losses are recoverable. That's true whether your license is from Malta, Curaçao, or anywhere else.

That said, not all EU markets work identically. Austrian courts have been the most aggressive — consistently ordering full repayment of losses. Germany is more complicated: the Dresden Regional Court (Landgericht Dresden) dismissed a director liability claim in early 2026, ruling that German law requires something closer to deliberate wrongdoing, not just operating without a license. The exposure is real in both countries, but operators should not assume they carry the same risk profile.

There's also a new enforcement tool that changes the calculus further. In pending case C-716/24, a German player won a judgment against an offshore operator and then moved to freeze the operator's bank accounts in Cyprus — where the operator routed its payments — using the EU's European Account Preservation Order (EAPO) mechanism. The Advocate General's preliminary finding: EU courts can freeze those accounts regardless of where the operator is licensed or incorporated. Insolvency proceedings opened outside the EU don't block them either. For operators who thought their payment infrastructure in EU financial centers like Cyprus, Luxembourg, or Ireland was safely out of reach, this is a significant development.

What operators should do and when

The window to act proactively is real, and it is closing. Getting a local license in Germany, the Netherlands, or Sweden takes 12 to 18 months under the best conditions. Operators who start now can get there before the litigation wave reaches their cohort. Austrian and German plaintiff law firms have been running industrialized claim operations against MGA-licensed operators since 2021 — aggregating hundreds of individual players into coordinated lawsuits and working on contingency. That machinery is profitable, it's expanding, and it doesn't care about jurisdiction labels. Operators who wait will be restructuring under legal pressure, with a documented history of operating without local authorization. That history matters both for the size of the liability and for any future licensing conversation.

One clarification worth making: offshore licenses are not dead across the board. For markets in Asia, Latin America, or Africa — where this restitution machinery doesn't exist — jurisdictions like Anjouan or Tobique still make commercial sense. The question isn't "offshore or local" as a general principle. It's which markets you're actually targeting, and whether your licensing structure matches that reality. The operators who get this right treat their EU business and their emerging markets business as separate problems with separate solutions.

What C-440/23 still leaves open

The ruling is binding and the direction is clear, but several questions remain unanswered — and they will shape how this plays out over the next two years.

First, how will courts apply the "player awareness" test? The CJEU left national courts room to reject restitution claims if a player demonstrably knew the operator was unlicensed. In practice, this filter has rarely been used to block claims — but as litigation industrializes further, operators may start challenging it more systematically.

Second, will the CJEU's final judgment in C-716/24 confirm the EAPO approach outlined by the Advocate General? If it does, the asset-freezing mechanism becomes a standard enforcement tool across the EU — and the practical value of offshore corporate structures collapses further.

Third, what happens to Malta's Bill 55? The European Commission's infringement proceedings (INFR(2025)2100) are ongoing. If the Commission wins, Malta will be forced to repeal Article 56A — removing the last procedural shield MGA-licensed operators have been using to resist enforcement in their home jurisdiction.

These are not abstract legal questions. Each of them will directly affect the scope of liability, the speed of enforcement, and the strategic options available to operators navigating this transition.

The bottom line

C-440/23 arrived wearing consumer protection clothing. The deeper effect is a structural reorganization of one of Europe's most profitable entertainment sectors — one that was long overdue.

The offshore shortcut is closing, and the operators who recognized this early are in a strong position. The ones still waiting to see how it plays out are not just accumulating liability — they are also running out of time to fix it on their own terms.