Technical Standards

Technical Framework of the New Licensing System

Finland’s transition to a partial-licensing model for gambling introduces a comprehensive set of technical standards that operators must meet to secure and maintain a licence. The Gambling Act, which comes into force on 1 July 2027, moves beyond the current monopoly structure held by Veikkaus Oy for online casino games and betting. The new system is designed to provide the state with robust tools for supervising a competitive market.

A core principle of the regulation is that all licensed operators must connect their gambling systems to government-controlled supervisory interfaces. This requirement, enforced by the National Police Board (Poliisihallitus), ensures transparent and continuous oversight. Technical compliance must be demonstrated during the initial licensing process, which began on 1 March 2026, and maintained throughout the licence period.

Mandatory Supervisory System Integration

To operate in Finland's licensed market from 1 July 2027, all holders of a licence for online casino games, betting, or electronic bingo must integrate their platforms with three key state-run systems:

• The regulator's data-vault model for supervision data.
• A national central self-exclusion register.
• The Official Control Signing Service (OCSS).

The Regulatory Data Vault

The data vault is the cornerstone of Finland’s technical supervision strategy. It is not a single central database where operators deposit all their data. Instead, it is a model that requires operators to structure their own data in a standardised way and provide the National Police Board with direct, secure, and continuous electronic access to it. This allows the regulator to monitor activities and perform automated checks without constant manual reporting from operators.

The data points accessible to the National Police Board are strictly defined for supervisory purposes. They include information related to player accounts, transactions (deposits, withdrawals, bets, wins), login history, gameplay events, and the use of responsible gambling tools. The processing of this personal data is overseen by the Data Protection Ombudsman to ensure it complies with privacy laws.

Central Self-Exclusion Register

As a key player protection measure, all licensed operators must connect to a central self-exclusion register. This system allows individuals to block themselves from accessing all regulated online gambling sites in Finland with a single action. Operators' systems must query the register in real-time to prevent excluded individuals from logging in or creating new accounts. This replaces the less effective site-by-site exclusion process.

Official Control Signing Service (OCSS)

The OCSS is a technical solution designed to ensure the authenticity, integrity, and non-repudiation of data transmitted between an operator and the supervisory authorities. By digitally signing critical data and reports, both parties can be certain that information has not been tampered with. This is vital for the legal validity of supervisory evidence and for maintaining trust in the regulatory process.

Game and Platform Requirements

Beyond system integrations, the gambling platform and the games themselves are subject to strict technical standards. The National Police Board requires that operators' systems are reliable, secure, and fair. This must be verified by an independent and approved testing laboratory as part of the licence application.

Game-Specific Parameters

The Gambling Act empowers the government to set specific technical limits for games through decrees. These standards are intended to control the risk profile of gambling products. While the exact numerical values were still being finalized through draft decrees as of mid-2026, the parameters to be regulated include:

• Random Number Generator (RNG): Games of chance must use a certified RNG to ensure unpredictable and fair outcomes.
• Return-to-Player (RTP): Minimum theoretical payout percentages for games will be established.
• Maximum Bet and Prize: Limits on how much can be staked and won in a single game round.
• Game Speed: Restrictions on the minimum time for a game cycle to prevent excessively rapid play.

Operators must be able to demonstrate to the National Police Board that all games offered to players in Finland adhere to these forthcoming parameters.

Licensing for B2B Suppliers

A significant development in the Finnish model is the introduction of a separate licensing regime for B2B suppliers. Under the current monopoly, Veikkaus manages its own supplier relationships. From 1 July 2028, any business that provides critical gambling software or platform services to a licensed operator in Finland must hold its own B2B licence.

The application window for B2B licences opens on 1 July 2027. This provides a one-year transition period for B2C operators to ensure their technology partners become compliant. This requirement extends regulatory oversight to the entire supply chain, ensuring that game studios, platform providers, and other key suppliers also meet Finland’s standards for integrity and security.