Bet365’s Sweden Fine: What a ‘Customer Protection Breach’ Really Means for Betting Site Safety

The fine Bet365 just failed to overturn

Swedish courts have upheld total sanctions of SEK44m (around €3.9m) against Bet365, composed of a SEK40m penalty plus a SEK4m penalty, for what regulators called serious and systematic breaches of duty of care and deposit limit rules between 2019 and 2022, according to reporting by Focus Gaming News on 15 October 2026. A casino player protection breach of this kind rarely looks dramatic from the outside. In this case, a large part of it came down to a drop-down menu.

The regulator’s central objection was that Bet365 let customers select a “no limit” deposit option. Swedish law requires players to set a specific deposit cap, and “no limit” is not a specific cap. The operator kept its Swedish licences after introducing stronger controls, including manual reviews of customers with high losses and closer monitoring of higher-risk players.

So the useful lesson here is not “avoid Bet365”. It’s that one of the largest, longest-established and most heavily licensed operators in the world ran a player protection setting that a regulator considered unlawful, for roughly three years, in a market where it was being actively supervised. If that can happen under Spelinspektionen’s nose, the advice most comparison sites give you, check that it’s licensed and move on, is doing far less work than you think.

What a customer protection breach actually means

A customer protection breach is a failure by a licensed operator to meet its legal obligations to prevent gambling harm: not offering or properly enforcing deposit and loss limits, mishandling self-exclusion, failing to check whether a customer can afford their losses, or marketing to people already showing signs of trouble. It is a compliance failure, not fraud.

That distinction matters. Regulators almost never fine an operator for stealing money. They fine it for the quieter stuff: a setting that was technically available but easy to bypass, an alert that fired and nobody actioned, a bonus email sent to someone whose losses had tripled in a month. Four areas come up again and again.

• Deposit and loss limits. Daily, weekly and monthly caps must exist, be easy to find, and actually bind. A good system applies a decrease immediately and delays any increase by a cooling-off period, so a player can’t raise their ceiling mid-session.
• Self-exclusion and cool-off. A short cool-off (24 hours to a few weeks) and a longer self-exclusion must be available, must take effect across the whole account, and must switch off marketing to that customer.
• Affordability and identity checks. KYC checks confirm who you are and that you’re of legal age. Affordability checks ask whether the money you’re losing is plausibly money you have. Regulators increasingly expect manual review of customers with unusually high losses, which is precisely the fix Bet365 introduced in Sweden.
• Responsible marketing. Promotions must not pressure, must carry risk messaging, and must not be aimed at self-excluded or high-risk customers. This is also where targeting gets uncomfortable: personalised gambling ads built on behavioural data can push offers at exactly the people who should be seeing fewer of them.

Why a fine in Sweden matters when you’re depositing from India

A fine in one jurisdiction matters because it tells you how an operator behaves when someone is watching, which is the best available evidence for how it behaves when nobody is. Swedish regulators audit, demand records and impose penalties. Most offshore-facing licences do very little of that.

There are two honest ways to read the Bet365 decision, and only one of them survives scrutiny.

The first reading: a multi-million euro penalty for systematic breaches is a reason to walk away. That isn’t stupid. Three years is not an accident, and the courts described the failures as systematic.

The second reading, which I think is the right one: an operator with a documented failure and a documented fix is a more knowable quantity than an operator with no enforcement record at all, because the second kind has usually never been examined. Silence is not a clean record. Of the hundreds of sites accepting Indian players through Curaçao, Anjouan or similar licences, almost none have ever had a regulator pull their customer files and ask why a player losing six figures a month was never reviewed.

But accept that reading and it comes with a sting. The specific failure tells you what an operator under-builds by default, and that default follows the brand into markets where nobody polices it. Bet365 offered “no limit” deposits until a regulator forced the issue. The site you reach from India is often a different entity, under a different licence, serving a market with no duty of care standard to breach. Assume the consumer protections you read about in a European press release are not the ones running on your account. Check them yourself.

Red flags that a site isn’t protecting anyone

The warning signs are mostly things that are missing rather than things that are visible. Here’s what to compare, side by side, before you create an account.

That last line is worth dwelling on. Sponsorships and ambassador deals are advertising spend, nothing more, and a famous name on a betting brand tells you nothing about how it treats customers.

Verifying a licence before you put money in

Verification takes about five minutes and settles most of the question. Do it in this order.

1. Scroll to the footer and find the licence number plus the name of the company holding it. If either is absent, stop.
2. Go to the regulator’s own website, not a link from the casino, and search its public register for that number.
3. Check that the register entry names the same legal entity and covers the domain you’re actually on. Group brands often operate under several entities, and only some are licensed in the market you think they are.
4. Confirm the regulator is a real licensing body with published enforcement actions. A regulator that has never penalised anyone is not reassuring.
5. Open the account settings and the responsible gambling page before depositing. Confirm limits, cool-off and self-exclusion exist and that help organisation links are present.
6. Test one tool. Set a small deposit limit, then try to exceed it. If the limit doesn’t hold, you have your answer, and you’ve learned it for the price of nothing.

The limits you set are the only ones you control

Set your own deposit cap and your own session time before you play, on every site, however well it checks out. Operator-side protections are a backstop, not a plan, and the Bet365 case shows how long a flawed backstop can sit in production before anyone corrects it.

Gambling carries real financial risk. Every game is built with a house edge, which means the expected result over time is a loss, and no tool or checklist changes that arithmetic. If betting has stopped being entertainment and started being a way to chase money back, use the cool-off or self-exclusion option and contact a support service in your country. And before you register on any offshore site, check the law where you live: online gambling rules in India vary by state, and winnings are taxable.

What the Swedish ruling can’t tell you is whether the version of a brand you reach from Mumbai or Kochi has the same controls the Swedish version was forced to build. Nobody audits that. So run the checklist yourself, test one limit with a small deposit, and treat any site that can’t survive five minutes of looking as a site that wasn’t built for you to look at.

About The Author

See author's posts