Player card to become the main tool of responsible gambling policy
Beginning in 2029, Lithuania will launch what the country’s authorities call the first fully centralised player monitoring system in the European Union. The country will introduce a personal card tied to the identity of everyone who places a bet, whether online or at a slot machine venue. The card will link deposits, wins and losses across all operators in the country into a single system, and cash as a payment method will become a thing of the past.
The Ministry of Finance of the Republic of Lithuania submitted the proposal on 2 April 2026. The reform will roll out in phases: expanded regulatory powers will take effect from 1 May 2027, and the card itself, along with the move away from cash, will take effect from 1 January 2029, with a three-year transition period for operators. SiGMA News spoke with Lithuania’s Gaming Control Authority (GCA; in Lithuanian, Lošimų priežiūros tarnyba, LPT), the regulator operating under the country’s Ministry of Finance, about the country’s reforms. The responses for this article were provided by Arnoldas Dilba, Head of the Legal Division at the GCA.
Problems the player card aims to solve
Lithuania’s current gambling law already requires operators to monitor player behaviour, recognise signs of excessive gambling and suspend access for 48 hours once a risk threshold is reached. Land-based gaming halls must appoint a person responsible for identifying problem behaviour, while online platforms have to maintain equivalent controls and record the results. Before playing remotely, a player must set a limit for each gambling session, as well as daily, weekly, and monthly limits, and these can only be increased no earlier than 48 hours after a request is submitted.
The problem, according to Arnoldas Dilba, is that all of these measures work only at the level of a single operator. Having exhausted the limit with one company, a player can freely move to another, circumventing the defensive mechanisms an unlimited number of times. It is precisely this fragmented, operator-level control that the player card is meant to close.
Changes in regulatory oversight
The card centralises data on a player’s deposits and winnings across the entire sector, regardless of whether the person plays remotely or at a physical venue, with one company or several. This enables the GCA to track financial flows and see the full picture of a person’s behaviour, rather than segmented data from individual operators.
“The card would also become the primary tool of responsible gambling policy. It would allow a single, sector-wide limit to be set, one that would prevent the current practice whereby a player, having exhausted the limit with one operator, simply moves to another and thereby circumvents it”
According to Dilba, this should reduce the risk of gambling addiction, strengthen the prevention of problem behaviour and genuinely bring the law closer to its stated goal: reducing the availability of gambling and the possible harm to health.
Similar cards already exist in Poland and Norway, but only for slot machines in land-based venues. Germany has a centralised database that tracks deposits capped at €1,000 per month, but no physical card is required. Sweden maintains a self-exclusion register and deposit limits, but no cross-operator tracking. Lithuania’s model claims to be the first to bring all channels, online and offline, and all operators together in a single mandatory instrument.
What restrictions already work
While the player card is still a matter for the coming years, the GCA already has measures in place. Since 2016, the regulator has blocked more than 2,000 illegal gambling sites, and the same list of domains is automatically shared with internet providers and financial institutions. The regulator has previously noted that, among the 19 EU countries, no other supervisory authority has a blocking system as extensive and far-reaching as Lithuania’s.
The newest, and likely most significant, tool is the so-called “white list”: financial institutions process payments only for companies included on it, identifying illegal operators by international payment card scheme codes rather than waiting for a specific site to be formally blocked. This closes a gap in the previous model, where payments were blocked only for sites that had already been blocked, while operators created new domains faster than the blocking procedure could keep up. Even if a player circumvents a site block, they typically can no longer top up their account using a legally issued Lithuanian payment instrument. That is the point of the new barrier, Dilba explains.
How the GCA monitors operators’ financial controls
A separate area of oversight concerns how operators verify the origin of client funds. One of the most telling recent cases is a fine of more than €300,000 imposed on an operator that failed to collect and assess information about a client’s source of funds and could not demonstrate that the amounts being wagered matched the data it held on that individual.
This case points to clear expectations for operators: know your customer (KYC) procedures must be applied not only at registration but on an ongoing basis, assessing whether bet sizes and deposit frequency, for example, match the data collected on the player.
Where discrepancies exist, documented confirmation of the source of funds is required. Cooperation with the GCA during an inspection is treated as a mitigating factor when a sanction is imposed, while a lack of cooperation is treated as an aggravating one. Dilba also stresses that operators cannot unilaterally impose restrictions on players, such as betting limits, citing anti-money laundering obligations as justification, unless such measures were clearly set out in advance in publicly published gambling rules; this was also confirmed by Lithuania’s Supreme Administrative Court.
Market growth and player protection: is there a balance?
Lithuania’s market continues to grow, driven mainly by the online segment. The GCA sees the balance between this growth and player protection not as slowing the market down, but as tightening the conditions under which it operates. Under amendments that took effect in November 2025, responsible gambling guidelines, previously only advisory, became mandatory for all operators, and the GCA gained direct access to accumulated player behaviour data to monitor how well these requirements are being followed in practice.
The second direction is a change to the sanctions system itself: from fixed amounts (up to €25,000) to fines tied to a company’s annual revenue, ranging from 2 per cent to 10 per cent, depending on the nature and repetition of the violation.
“For operators holding a larger market share and experiencing more growth, the potential sanctions increase correspondingly, thereby integrating the very logic of growth into the deterrence mechanism”
These are joined by direct protective measures: a uniform age limit of 21 for all forms of gambling, which took effect on November 01, 2025, a mandatory qualified staff member at land based venues to identify problem behaviour, and, further ahead, the player card itself as a long term solution allowing gambling to be restricted at the level of the entire market rather than a single operator.
Lessons from the Lithuanian model
The Lithuanian model is often described as one of the most complex enforcement schemes in Europe, combining site blocking, payment restrictions and a “white list” of operators. But according to Dilba, none of these measures works on its own.
“The main lesson is that technical website blocking alone is insufficient, since it can easily be circumvented via VPNs or changing DNS settings, which is why a financial barrier is needed, one that works even when a user does manage to reach an illegal website”
The second lesson is the importance of distributing responsibility among the system’s participants: the regulator compiles and publishes the list of legal operators, while financial institutions are required to apply it using the codes of international payment card schemes. Part of the enforcement burden is thereby shifted to the private sector, which has direct access to payment data.
The third lesson is that it is more effective to tie sanctions to a company’s revenue than to a fixed amount. This ensures that the deterrent effect does not weaken as the market grows and operators grow larger. Finally, it is critical to recognise that operator-level protective measures (limits, suspensions) are of limited effectiveness on their own if a player can freely move between companies. That is precisely what pushed Lithuania toward a centralised player card covering the entire sector.
What comes next
Formally, the player card is still almost three years away. Until 2027, the GCA will continue working largely with the tools it already has: blocking, the payment barrier, and rising fines. But the logic is already set: each of these measures closes a specific gap in a system that, until now, consisted of multiple isolated restrictions and no unified view of the player.
The real test of this model will not be how many sites the GCA blocks before 2029, but whether the card actually closes the very loophole it was built to address: a player’s free movement from one operator to another, circumventing any limit along the way.
This article was first published on the Russian SiGMA News page on 20 July 2026.
Rome sets the scene, but the future is the focus. From 02–05 November 2026, SiGMA World brings 30,000 industry leaders together to explore what’s next and who to build it with. Come for the conversations, stay for the possibilities.
