How much does a person have to lose at a single online casino before someone is obliged to ask where the money is coming from and whether the player can still control their behavior? One million euros? Ten million? Thirty million? According to the European Public Prosecutor's Office, Lithuanian Šarūnas Stepukonis may have lost €31.6 million at one Estonian casino. This is no longer just a story about one person's greed, addiction, or bad decisions. It is a story about a system that saw money moving but may not have applied the brakes in time.

At the same time, Estonia is making itself more attractive to international online casinos. Tax revenue is welcome — that was the message of the reform that took effect at the start of the year. But before opening the door, we must ask whether the guard is already in place or will only arrive after the money and the people are gone.

Does anyone take responsibility for the whole thing?

According to the Tax and Customs Board (MTA), by the end of 2025 Estonia had issued 53 gambling licenses and 38 tote betting licenses to a total of 44 companies. This is not a small market. In 2024, the MTA closed 140 gambling supervision proceedings, and in 2025, 132. The gambling oversight team was increased from six positions to eight.

As part of the reform, up to three additional positions were also planned for the Financial Intelligence Unit (FIU). The FIU did not initiate any proceedings in the casino sector in 2024 and initiated two in 2025. The FIU has assessed the sector's residual money‑laundering risk as high and found that the fragmented supervision model is not optimal.

The MTA monitors compliance with the Gambling Act, the FIU oversees anti–money laundering requirements, and other bodies supervise advertising, consumer protection, and personal data. Everyone watches their own corner, but someone must see the whole room. Adding a few extra positions alone does not create a comprehensive oversight model. As it stands, institutional responsibility may become so dispersed that, in the end, no one is truly accountable.

There is also another concern: the MTA collects taxes from casinos while at the same time it must be ready to squeeze that same source of revenue, restrict its activity, or revoke its license. It is hard to count tax money with one hand and shut down the source of that money with the other.

€26,000? Pocket change for a large casino

For many violations, the law sets a maximum fine of €26,000. For a large international online casino, that is negligible. A fine can become just a cost of doing business if the gains from violations exceed the sanction. Effective penalties must depend on the size of the casino and its gambling revenue. If a casino's violation has caused demonstrable harm to a player, the player must have a simple and effective way to obtain compensation.

 The current law establishes a solid starting point. Casinos must identify players; self-exclusion is available, as is the option to set loss limits. There are requirements for casino owners and managers, and the FIU participates in the licensing process. The problem is not that there are no rules. The problem is that online casinos have evolved faster than the rules.

Fast game cycles, flashing effects, bonuses, and disguising losses as apparent wins are not just design choices. These techniques can prolong play and blur a person's understanding of their actual losses. A casino knows its customer, tracks behavior, and knows when to offer a new bonus. If a casino can use player data to lure someone back to play, it must be able to use that same data to detect risk.

Casinos must have a clear obligation to identify risky behavior and intervene before damage becomes catastrophic. Oversight cannot be limited to checking documentation for technical software compliance. Regulators must also look under the digital hood of casinos: how algorithms assess players and whether they can be altered without control, how bonuses are offered, when a person is classified as at risk, and whether the casino actually intervened.

Four changes for better oversight

The casino reform has generally started with the right steps, but four additional changes are needed. Fines must be tied to the size of the casino and must be genuinely dissuasive. In the current fragmented system, one authority should be given clear responsibility for the overall risk picture of the casino sector, a unified supervisory plan, and coordination of its implementation — without creating major conflicts of interest.

Binding general requirements must be established for certain aspects of games. The law should further clarify the obligation of active player protection, taking into account the specifics of online casinos.

Estonia can be an attractive location for international online casinos. But attractiveness cannot mean opening the door to casinos first and strengthening oversight later. We have already seen this movie in the crypto market: first came the companies, then the problems, and only afterward the state. There is no need to repeat the same mistake with online casinos.

--

Follow ERR News on Facebook and X and never miss an update!