The Swedish Gambling Authority (Spelinspektionen) has issued new regulations that tighten the technical requirements for licensed gambling operators in Sweden. The new rules clarify and standardise how operators must technically connect to Spelpaus, Sweden’s national self-exclusion programme.
The updated rules, decided on 23 April and published on 29 April, will take effect from 1 August 2026.
What are the new rules?
- Each licence holder will receive a unique Actor ID and API Key. These credentials are mandatory when querying the self-exclusion register. Additionally, checks must be conducted before sending any direct marketing communications.
- Verification is required during new player registration, while operators must check self-exclusion status when players attempt to log in.
- Marketing-related checks must be made via a dedicated marketing API, while checks during player registration and login must use a distinct login API.
- A self-exclusion check is considered complete once it definitively confirms whether an individual is excluded.
Sweden’s national self-exclusion register, Spelpaus, was introduced following the country’s 2019 gambling regulatory reform. It mandates all licensed operators to block access for individuals who have self-excluded. Swedish law requires all operators with a local licence to integrate the register into their offerings.
Players have the option to exclude for several set periods. These include one, three and six-month breaks, while users can also opt to block themselves for 12 months or more.
The register was updated in 2023 to offer easier access to guidance and information on gambling problems. It also included an option for players to extend the period of self-exclusion.
Responsibility remains with the licence holder
The regulations explicitly state that responsibility remains with the licence holder, even if technical checks are delegated to third-party service providers. Licence holders must ensure that their assigned Actor ID and API Key are used at all times, emphasising that outsourcing does not absolve operators from compliance duties.
While the regulations define the overarching technical framework, they do not yet include detailed API specifications, response formats, or service performance standards, information crucial for integration planning.
Spelpaus was under scrutiny just last year after a documentary series alleged that the register experienced a data breach.
The regulator was quick to reject the claims and emphasised that all information was encrypted.
“There is no information about whether the person who has excluded themselves is addicted to gambling or not,” a spokesperson said at the time.
Kathryn Evans
Kathryn covers bitesize breaking news with a primary focus on EMEA and US legislation. A proud North Walian, fluent Welsh speaker and lifelong Wrexham FC fan – long before Hollywood came calling.
