With Finland’s regulated commercial gambling market set to launch in July next year, Partner Jon Hautamäki and Associate Trainee Niko Hannolainen at Helsinki-based law firm Nordic Law provide iGaming Expert with a deep analysis of the regulation and the direction the market is heading in.
The success of the entire gambling reform depends on whether licensed operators can win players back from the offshore market. Several regulatory tracks are developing on top of the Gambling Act, but their cumulative effect on channelisation has not yet been considered.
Finland’s online gambling market will open to licensed competition on 1 July 2027. Applications for operator licences will open on 2 March 2026. For the first time, private operators will be able to offer sports betting, online casino games, online slots and online money bingo under a regulated framework. Physical slot machines and casino games will remain under a separate, state-controlled, exclusive license.
The Gambling Act is based on the same licensing system as Denmark and Sweden. The goal is to build a competitive licensed market that draws players in, enforces against unlicensed supply and delivers policy objectives through channelisation.
Finland’s channelisation rate across digital channels is roughly 50%. It was 90% a decade ago. According to the legislative history of the Gambling Act, channelisation is the primary mechanism through which the act’s objectives, including harm prevention, will be achieved.
Nordic Law advises international gambling operators on Finnish licensing, regulatory compliance and market entry strategy. During the public consultation on the player protection proposals in February 2026, we submitted a detailed legal analysis.
Duty of care
In January 2026, the Ministry of Social Affairs and Health‘s Assessment Group published its player protection recommendations. The consultation process received significant criticism, and our concerns were not unique.
The consultation revealed a sharp political divide. The Prime Minister’s Office, several international operators and industry bodies argued against implementing recommendations in their current form. In contrast, welfare districts, health organisations and the CEACG research group at the University of Helsinki took the opposite position, calling for the recommendations to be binding and centralised across all operators.
The proposed model introduces a six-tier intervention ladder. Pop-ups are triggered at €25 per month. The account freezes temporarily at €100. A full freeze requires personal contact to lift at €200. The annual loss cap is €5,000.
To illustrate what this means in practice, consider a player who deposits €50 every Friday to bet on weekend soccer games. By the fourth week of the month, that player would have encountered four deposit pop-ups, four time-use pop-ups, four 90-second mandatory breaks, one temporary account freeze and one full freeze that requires personal contact to reactivate the account.
The €5,000 cap is operator-specific. In a market with dozens of licensed operators, a player’s actual annual losses across the system could far exceed that figure. This structural weakness was raised by the Competition and Consumer Authority, the National Police Board and several other consultation respondents. Currently, no single operator can see the full picture of a player’s gambling activity; yet, the entire duty of care model is built on operator-level data.
Furthermore, based on the proposed model, five logins per month trigger email alerts. Playing three different games in one week triggers a pop-up. Players aged 18 to 24 face tighter limits, starting at €20 per month.
All thresholds apply uniformly to sports betting, casinos and poker, regardless of risk profile.
Section 34 of the Gambling Act requires an automated, individualised harm assessment. The Assessment Group concludes that predictive models developed using AI and machine learning are still in the early stages of development. These models cannot independently fulfil the duty of care, nor should they be given significant weight when complying with statutory obligations. The group proposes uniform thresholds instead. In our view, this is difficult to reconcile with what the Act actually requires.
Although the recommendations are non-binding, the Assessment Group states that they will serve as the supervisory authority’s compliance evaluation tool. In practice, this makes them the regulatory baseline, regardless of their formal status.
Germany’s strict deposit limits have resulted in channelisation rates of 20% to 40% for online slots. Meanwhile, the Netherlands fell below 50% after tightening its player protection measures. Finland’s proposed thresholds are stricter than those of either country.
We believe that the proposed intervention ladder, particularly the €100 temporary account freeze, will prompt players to seek offshore alternatives, where such limits are not in place. The outcome of this policy debate will determine the regulatory environment that operators will enter in July 2027.
Marketing
The Gambling Act bans affiliate marketing and limits social media use to operators’ own accounts on a non-interactive basis. The Act also prohibits acquisition bonuses and influencer promotions. All marketing must be moderate and operators must have direct control over all content.
Despite the Act setting the age threshold at 18, the Assessment Group proposes a blanket marketing ban on 18- to 24-year-olds, in addition to statutory restrictions. Finland’s Constitutional Law Committee has noted that restrictions of this kind require a legislative basis. However, the Act contains no such provision.
Licensed operators will enter a market dominated by unlicensed competitors in Finnish-language search results. The channelisation rate dropped from 90% to 50% under the monopoly. The defining commercial challenge is winning those players back with fewer acquisition tools than any comparable Nordic market, combined with the proposed duty of care thresholds and hence, a more restrictive player experience.
While Denmark blocks unlicensed domains through court-ordered ISP filtering, Finland goes further by empowering the regulator to order hosting providers and domain registrars to remove unlicensed content and delete domain names at their discretion. How far these powers extend beyond Finnish and EU jurisdiction is another matter entirely.
Technical standards
In November 2025, Finland notified the European Commission of two draft technical regulations, both of which will take effect on 1 January 2027. One covers gaming system security and requires external audits every two years. The other requires independent randomness checks, including a review of the source code of all RNG components.
In February 2026, the National Police Board published its first draft of binding regulations under the Gambling Act, setting a consultation deadline of 27 March 2026. These regulations specify how operators must report game event and player account data to the supervisory authority.
The reporting system resembles Denmark’s TamperToken model. Finland calls its version OCSS. Using this government-provided service, operators must cryptographically sign all game events and player account data before delivering it to the regulator.
The authority pulls data from a dedicated data vault that each operator is required to build and maintain. This vault provides the regulator with visibility into player profiles, deposit and loss limits, self-exclusion status, bonuses offered and transactions that change account balances.
All data must be signed, timestamped and retained for five years. Operators must be able to reconstruct and redeliver historical data upon request.
With access to this level of data, a regulator can verify that operators are complying with loss limits, self-exclusion obligations and bonus restrictions. This supervisory capacity distinguishes jurisdictions that maintain channelisation from those that do not.
By default, game servers must be located in Finland. Operators licensed in other jurisdictions may apply for an exemption if their home regulator has an agreement with the Finnish supervisory authority or if the operator enables remote verification of system integrity. Cloud infrastructure is permitted, but the location requirements apply to the hardware.
Software licensing
Starting in July 2028, operators must source all gaming software from suppliers with a Finnish software licence. Applications for software licences will commence on 1 July 2027.
The licence applies to any entity that manufactures, delivers, installs or adapts software for licensed gambling activities. The determining factors are who controls the content and final product and who holds the intellectual property (IP) rights.
A subcontractor performing a limited task does not need a licence. However, an aggregator that delivers a game studio’s product with minimal modifications or as-is will need a licence.
The government bill frames software licensing as a channelisation measure. It restricts the availability of software to unlicensed operators in Finland and prevents Finnish subcontractors from supplying offshore operators without the knowledge of the relevant authority.
A software licence is less restrictive than an operator licence. There is no ongoing reporting or mandatory audits. However, operators will go live in July 2027 on platforms from suppliers who will not have Finnish licences until early 2028. If a supplier fails to apply or does not pass the fit and proper test, the operator needs a backup plan.
Anti-money laundering
The EU Anti-Money Laundering Regulation will take effect on 10 July 2027, which is ten days after the Finnish market opens. The AMLR classifies online gambling by non-state actors as high risk, establishes a €2,000 customer due diligence (CDD) threshold for occasional transactions, and requires enhanced due diligence for politically exposed persons.
For the first time, the AMLR allows operators to share suspicious transaction data with each other under certain conditions. In a multi-licence market, where players can spread their activity across dozens of platforms, no single operator has a complete view.
Finland’s 2023 national AML risk assessment directly identified this issue, noting that investigating suspicious transactions through cooperation between obliged entities is practically impossible under the current framework. AMLR provides a new opportunity for operators to address this issue collectively.
The assessment was written under the Fourth and Fifth AML/CFT Directives and is based on a single state-owned operator. A new assessment reflecting the multi-licence market is expected by July 2027.
What comes next
The licence application window for the gambling licence opens on 2 March 2026. While the regulatory landscape is still shifting, operators should prepare their applications. Throughout 2026, the supervisory authority will publish binding technical regulations. We will track each consultation and publish analyses as the regulatory framework develops.
Jon Hautamäki is a partner and Niko Hannolainen is an associate trainee at Nordic Law Oy, a Helsinki-based law firm that specialises in fintech, Web3 and gambling regulation. Drawing on extensive experience guiding clients through EU and national licensing processes, we are well-positioned to support operators preparing to enter the Finnish market. We’re welcoming any opportunity to discuss how we can assist with the successful launch of your gambling services as one of the first new license holders in Finland.
