Firstly, I'd be careful with wording - there is a significant difference between a "crime" (proven in a court of law) and an "administrative penalty" ("bestuurlijke boete", imposed by a government body).
It was no coincidence that the KSA started to flex their muscles a couple of years before they introduced formal licensing in 2021 - both by applying administrative fines, and by imposing a 33 month "cooling-off" period for operators who had an unlicensed presence prior to 2021.
When it comes to "grey markets", many will naturally think of Curacao - but many European players used to play with Isle of Man (as with PokerStars) or Alderney operators also.
The ambiguity comes from the legality - it was legal for a IoM/Alderney casino to offer licensed gambling remotely, it was legal for a player to register and play on said sites, it
might not be legal to operate in the country itself (and in the case of PokerStars, is where the KSA seemed to lean on - the use of iDEAL payment processing, and the use of Dutch professionals like Lex Veldhuis).
It's certainly not as clear cut as the OP is making out - if we highlight that:
- Many of the enforcement actions are administrative penalties or cease and desist notices - naturally operators are more willing to comply if they wish to enter the regulated NL market or they have other EU/UK operations (because even if the KSA can't do anything, their own regulator can ask "fit and proper" questions if the operator refused).
- There is a tension between national and EU law, as the Dutch authorities found out when they
- after five years of legal wrangling the consensus was that as PokerStars EU was based in Malta, EU law overrides NL law and gambling tax could not be imposed on players however Pokerstars FR was (at the time) based in Isle of Man, and because IoM is not part of the EU, then NL law applies and players were liable for gambling taxes.
- For problematic jurisdictions (like Curacao), the KSA are - like any other industry - forced to target local footprints - they will target local partners like payment providers or advertising partners instead, the ICLG article (below) notes that they've struggled to collect fines from foreign operators.
Additional background:
Which comes back to the OP and the legal ambiguity - Flutter's legal team have pretty much explained the situation - they were based in Malta, held a MGA license, and could offer their services to EU players.
This had already been tested in court by Betfair (a Flutter company) in
(warning, it's a lot of legalese - but parts 48 to 55 are the key ones, which seemingly gives Betfair the green light to operate in this way until NL offer an open licensing model).
So to summarise: they operated legally within the legal framework that was available, the KSA wanted to flex their muscles and issued a fine, because KSA were planning to introduce open gambling licenses (the pivotal clause they lost on in the 2010 court case) it made sense for PS to pay up rather than challenge it and risk setting a bad precedence for themselves.
... and breathe ?
<disclaimer: I am not a lawyer, this is for general information only>