Scam Spotters The Self-Exclusion Reset: Licence Changes Can Erase Your Protection

[Nate]

Part 7 of the Scam Spotters Series

You did the right thing. You recognised a problem, took responsibility, and self-excluded from a casino. For six months, maybe a year, maybe permanently. The casino confirmed it. You moved on with your life.

Then one day you receive a marketing email from that same casino. Or you visit the site out of curiosity and discover you can log in. Your self-exclusion has vanished. The casino acts like it never happened.

What went wrong? The casino changed its licence. Not its owner. Not its management. Just the licence number. And when it did, your protection may have disappeared with it.

How Self-Exclusion Is Supposed to Work​

Self-exclusion exists to protect vulnerable players. When you self-exclude from a casino, you're asking them to lock you out for a set period. No marketing. No account access. No way to deposit. It's a safety net for people who recognise they need a break from gambling.

Under MGA (Malta Gaming Authority) rules, casinos must maintain a self-exclusion register. When you request exclusion, they add you to this list and block your access. Simple enough.

But here's what most players don't realise: that register is tied to the licence. And when the licence changes, what happens to that register is far from clear.

The Licence Question​

MGA self-exclusion is licence-scoped. The MGA's own rules state that exclusions "must apply across all brands under the same licence." Read that carefully. Under the same licence.

This raises an obvious question: what happens when the licence changes?

The same owner, running the same casino, with the same management and the same website, could reset their self-exclusion obligations simply by surrendering one licence and obtaining another. No change of ownership required. No sale of the business. No new management. Just paperwork.

What the MGA Actually Requires​

​

The MGA publishes a Licence Surrender Guidance Note detailing exactly what happens when an operator gives up their licence. Section 3.3 lists the specific data the regulator extracts during a surrender:

1. Customer's name and surname
2. Customer's Player ID
3. Customer's e-mail address
4. Customer's residential address
5. Customer's country of residence
6. Customer's date of birth
7. Currency type of account
8. Cashable Balance
9. Funds in play/open bets
10. Pending pay-outs

Notice what's missing? Self-exclusion status. The MGA explicitly details the 10 data fields it cares about during a licence surrender. Self-exclusion isn't one of them.

The guidance does mention player migration — but only in discretionary terms. Section 3.2.2 states:

"For the avoidance of doubt, if the intention of the Licensee is to transfer the business to another authorised person, or to transfer its current operation under the remit of a different regulatory framework, the Licensee shall be required to adhere to any player migration procedures as may be deemed to be applicable by the Authority."

You can read the full guidance note here:

You do not have permission to view link Log in or register now.

The Bus-Sized Loophole​

Let's be clear about what this means.

The regulator has discretion to demand record transfers during licence surrenders, but there's no automatic mechanism or requirement. It only happens if someone complains and the MGA decides to act.

So an operator accumulates self-exclusion requests from vulnerable players. Complaints mount. Regulatory scrutiny increases. The operator decides it's time for a fresh start.

They surrender their current MGA licence. They apply for a new one. Same company. Same directors. Same casino brands. Same everything — except the licence number.

The MGA's mandatory data extraction covers player funds. It doesn't cover self-exclusion status. Unless a player complains and the MGA chooses to intervene, the new licence comes with a clean sheet.

This isn't operators exploiting an obscure technicality. This is how the framework is written.

No Unified Database​

You might assume there's a central MGA database tracking all self-excluded players across all licences. There isn't.

The MGA launched a consultation on creating a unified self-exclusion system back in 2020. The idea was simple: exclude yourself from one MGA-licensed casino, and you're excluded from all of them. A central register that follows players, not licences.

It's now 2026. That system still doesn't exist. No implementation date has been announced. The consultation came and went, and nothing changed.

So each licence maintains its own separate register. There's no cross-referencing. No automatic sharing between licensees. And when a licence is surrendered, there's no mandatory requirement for self-exclusion data to go anywhere.

You can read more about the MGA's 2020 consultation here:

You do not have permission to view link Log in or register now.

Even Within Licences, Enforcement Fails​

If there were any confidence that the current system protects players adequately, a February 2026 MGA thematic review put that to rest.

The review, titled "Thematic Review on Self-Exclusion Practices in the Online Gaming Sector," examined how operators handle self-exclusion across their own brands. The MGA covered 20 licensees and 58 active URLs, using mystery shopping to test real-world behaviour rather than relying on documented policies.

What did they find?

Three licensees allowed self-excluded players to register, deposit, and gamble on other brands under the same licence simply by using similar personal information. Not a different licence — the same licence. Players who self-excluded from one brand could walk into another brand owned by the same operator and start gambling again.

The MGA's own conclusion: operators need "centralised exclusion databases and real-time data matching tools" to strengthen controls.

If operators cannot even enforce self-exclusion properly within a single licence, what confidence can players have that their exclusion would survive a licence change?

You can read more about the February 2026 review here:

• You do not have permission to view link Log in or register now.
• You do not have permission to view link Log in or register now.

The Jurisdiction Escape​

Some operators don't just change MGA licences. They abandon MGA licensing entirely.

A brand operating under MGA regulation accumulates self-exclusion requests and player complaints. Then the operator moves that brand to a Curaçao licence, or Anjouan, or no licence at all. The URL stays the same. The games stay the same. Players get a "please re-register" notice.

The self-exclusion register? It was tied to the MGA licence that no longer exists. The new jurisdiction has no record of it. The new regulatory framework (if there even is one) has no obligation to honour it.

We've documented exactly this pattern with casino groups that shuffle brands between jurisdictions when regulatory pressure mounts.

Protecting Yourself​

Until regulators close this gap, players need to take extra steps:

Use GAMSTOP (UK) or national schemes where available. GAMSTOP covers all UKGC-licensed operators regardless of licence changes. If you're in a jurisdiction with a centralised self-exclusion scheme, use it. It's more robust than relying on individual casino registers.

Self-exclude at the operator group level, not just the brand. If a casino is part of a larger group, request exclusion from all brands in that group. Document the request. Get written confirmation.

Keep records of your self-exclusion requests. Screenshot the confirmation. Save the emails. Note the date and the licence number if visible. If your exclusion is later ignored, this documentation becomes evidence for a complaint.

Monitor for "re-register" requests. If you receive a "re-register your account" email from a casino you self-excluded from, that's a red flag that something has changed. Do not re-register. Contact the operator and demand your exclusion be honoured. File a complaint with the MGA if they refuse.

Use bank-level blocks as a backup. Many banks now offer gambling blocks on your cards. These work regardless of which licence operates the casino. Consider this a second layer of protection that can't be wiped by corporate restructuring.

Report breaches. If a casino you self-excluded from allows you to deposit after any kind of licence change, report it immediately. The MGA can investigate, but only if players complain. Your report may protect others.

The Bottom Line​

Self-exclusion should be a safety net. Under current MGA rules, that net has a bus-sized hole in it.

Self-exclusion is explicitly scoped to "the same licence." There is no unified database across licensees. The MGA's own Licence Surrender Guidance Note lists ten data fields to extract — and self-exclusion isn't one of them. Any requirement to transfer self-exclusion records during a licence change is discretionary: "as may be deemed to be applicable by the Authority."

In plain English: unless someone complains and the MGA decides to act, self-exclusion records can simply vanish when a licence changes.

If you've self-excluded from an MGA casino, don't assume you're protected forever. Use centralised national schemes where available. Keep your own records. And if your exclusion vanishes after any kind of licence change, make noise. The regulator won't fix what they don't hear about.