What Bet365 was fined for in Sweden
Sweden’s gambling regulator, Spelinspektionen, sanctioned Bet365 over serious and systematic breaches of duty of care rules and deposit limit requirements committed between 2019 and 2022, and the operator has now lost its appeal against those sanctions. The fines total more than €3.5 million: SEK 40 million plus a further SEK 4 million.
The specific failure at the centre of the case is unglamorous and worth understanding. Bet365 let customers pick a “no limit” option when setting their deposit cap. Swedish law requires players to set a specific limit, and regulators found that offering “no limit” did not satisfy that requirement. A box on a sign-up form, in other words, became a multi-million euro problem.
Here is the part that should change how you read licence badges. Bet365 held valid Swedish licences throughout the period under investigation, and it kept them. The courts upheld that the breaches were serious, but the operator avoided licence revocation after tightening its responsible gambling controls, including manual reviews of high-loss customers and closer monitoring of higher-risk players. A licence was never missing here. The standard advice, “check it’s licensed”, would have told you nothing.
What a customer protection breach actually means
A customer protection breach is a licensed operator’s failure to meet its legal duty of care to players: not spotting or acting on signs of gambling harm, not enforcing the spend controls the law requires, or not applying the safeguards its licence conditions oblige it to apply. It is a compliance failure, not fraud, and the operator usually keeps running while it is investigated.
The categories regulators tend to pursue are fairly consistent across markets.
| Breach category | What it looks like in practice |
|---|---|
| Missed problem gambling signals | Escalating deposits, chasing losses, all-night sessions, with no intervention or contact from the operator |
| Weak affordability or source-of-funds checks | A customer deposits far beyond any plausible income with no questions asked |
| Deposit limit failures | Limits that are optional in practice, easy to raise instantly, or sidestepped by an “unlimited” option |
| Delayed self-exclusion enforcement | A self-excluded account still accepting bets, or marketing still reaching an excluded player |
| Marketing aimed at at-risk players | Bonus pushes and reactivation offers sent to accounts already showing harm indicators |
Notice that none of these are about whether the games are rigged. RTP, RNG certification and payout fairness sit in a separate compliance bucket. A site can have perfectly audited games and still fail its customers badly.
Why regulators are pushing harder on player safeguards
Responsible gambling compliance has shifted from a documentation exercise to something regulators actively test, and the Swedish case shows what that shift looks like: the regulator treated a limit-setting interface as a breach of law, courts backed it, and the penalty ran into millions. Regulated European markets have broadly moved in the same direction, raising expectations on operator duty of care and pairing them with anti-money-laundering obligations.
What operators in licensed markets are generally expected to do now includes monitoring player behaviour for harm indicators rather than waiting for a complaint, acting on those indicators with real interventions, enforcing deposit and loss limits in a way players cannot casually override, honouring self-exclusion immediately and across all channels, and documenting all of it so a regulator can audit the decision trail.
Bet365’s own remedy is instructive. It added manual reviews of high-loss customers and enhanced monitoring of higher-risk players. That is a human reading an account, not an algorithm filing a note. The direction of travel is towards operators having to show their working.
What a properly regulated operator already owes you
KYC and age verification
KYC gambling rules exist to confirm you are who you say you are, that you are of legal age, and that your money is legitimately yours. Expect identity documents at registration or before a first withdrawal, and expect source-of-funds questions if you deposit heavily. Those questions are intrusive by design. An operator that never asks them, no matter how much you move through the account, is not being generous with you.
Deposit limits and self-exclusion tools
The baseline is a deposit limit you can set yourself, loss and session limits, a cooling-off period, and permanent self-exclusion. Two details separate real tools from decoration. Increases should take effect only after a delay, while decreases apply immediately. And self-exclusion should close the door on marketing as well as betting. The Swedish case turned on exactly this kind of detail: a limit field that let you opt out of having a limit is technically a limit field, and legally it was not good enough.
Fund segregation and financial safety
Player fund segregation means your balance is held separately from the company’s operating money, so it is not spent on salaries, marketing or debts. Licensed markets usually require some form of it, and the operator’s terms or licence page should say which protection level applies. If a site cannot tell you where your deposits sit, treat the balance as money you have lent to a business rather than money you hold.
Before you sign up: checks worth doing in ten minutes
These licensed betting operator checks are tedious and genuinely useful. Do them before you deposit, not after a withdrawal stalls.
- Find the licence number in the site footer, then look it up on the regulator’s own public register. Do not trust the logo. Logos are images, and images can be copied. The register entry should match the company name and the website domain exactly.
- Check whether the licence actually covers you. A licence issued for one market does not automatically mean the operator is authorised to serve players elsewhere, so read the terms on accepted countries rather than assuming.
- Confirm which KYC documents are accepted before you deposit. Indian players should check that standard documents such as PAN and Aadhaar-based verification are supported, and that the name on your payment method matches your account name. Mismatches are the single most common cause of blocked withdrawals.
- Check your own state’s position on real-money online betting in India, because rules are not uniform across states. This is a point to verify for your location rather than take from any operator’s marketing.
- Open the responsible gambling page before you register. Set a deposit limit on day one and see whether the tools behave as described, particularly how long an increase takes to apply.
- Find the complaints process and the dispute route. A serious operator names an internal escalation path and an external body you can take an unresolved complaint to. Vague wording here tells you how a dispute will go.
- Test support with a real question before you have money at stake. Response time and whether you get an answer rather than a template is cheap information.
Red flags that point to weak player protection
- No licence number anywhere, or a number that returns nothing on the regulator’s register.
- No responsible gambling page, or links that go nowhere.
- Heavy bonus pressure with no wagering terms in plain view. A 30x wagering requirement on a ₹1,000 bonus means ₹30,000 staked before withdrawal, and an operator that hides that figure is telling you something.
- Large withdrawals paid with no verification at all. That sounds like a feature until you realise the same absent checks apply to everyone else on the platform.
- Deposit limits that can be raised instantly, or no limit option at all.
- Support that exists only as an email form, with no reply.
- Reactivation offers arriving after you asked to stop. This is the clearest signal of all.
What this case does not tell us
The public record here covers the breach, the period, the penalty and the appeal. It does not tell us how many customers chose the “no limit” option, how much they deposited, or whether specific players were harmed as a result. Regulatory findings of a systematic failure are not the same as a published count of affected accounts, and no honest figure exists to put in that gap. Anyone who gives you one is guessing.
What the case does settle is narrower and more useful: a long-established, fully licensed, well-capitalised operator in a strictly regulated market was found to have run a deposit limit system that did not meet the law for three years, and it took a regulator and two levels of appeal to force the change. The licence did not catch it. The regulator did, eventually.
So treat a licence as the minimum entry requirement rather than a verdict on safety. The things that actually protect you are the ones you can check yourself in an afternoon: a verifiable register entry, working limits, a self-exclusion tool that holds, clear bonus terms, and a complaints route with a named external body at the end of it. Online betting customer protection is partly something you are given and partly something you set up on your first day with an account.
Bet with money you can afford to lose, set your deposit limit before your first stake rather than after a bad week, and use cooling-off or self-exclusion if betting stops feeling like a choice. Every regulated operator has those tools. The Swedish case is a reminder that they only matter when someone, including you, insists they work.
