Malta Bill 55 Crisis: What Operators Should Do Before the CJEU Final Ruling

For two decades, Malta was the answer.

If you wanted to operate online gambling across Europe with a single licence, you incorporated in Malta, got an MGA licence, and sold services into Germany, Austria, the Netherlands, Sweden — wherever players were. The MGA licence was your passport. Bill 55 was your insurance policy.

That ended on April 23, 2026.

EU Advocate General Nicholas Emiliou issued an opinion calling Article 56A — the heart of Bill 55 — "manifestly incompatible with the rules governing the recognition and enforcement of judgments" under Brussels I bis. Just one week earlier, on April 16, the Court of Justice of the European Union confirmed in a separate ruling that Maltese gaming licences are valid only in Malta. The European Commission has opened infringement proceedings in June 2025.

For the thousands of operators relying on the Malta-as-EU-passport model, the foundation just cracked. The CJEU final ruling won't come for months, but the strategic question is already on the table: what do you do now?

This article is a working playbook, not a legal opinion. We've built it for operations teams who need to start preparing today, before the ruling forces decisions in a panic.

1. What Bill 55 Was Supposed to Do

Bill 55 became law in June 2023 as an amendment to Malta's Gaming Act, formally adding Article 56A. The provision instructed Maltese courts to refuse recognition and enforcement of foreign judgments against MGA-licensed operators — when those judgments concerned services that were lawful under Maltese law.

In practice, this meant a German court could rule that an MGA-licensed operator had unlawfully served German players without a German licence and order the operator to refund player losses. Under normal Brussels I bis rules, that judgment should be enforceable in Malta. Bill 55 instructed Maltese courts to refuse.

The political logic was straightforward: Malta's gaming sector was facing hundreds of millions of euros in player refund claims, mostly originating in Austria and Germany, where players had successfully argued that MGA-licensed operators served them without local authorisation. Bill 55 was a legislative shield to protect a major Maltese industry from foreign liability cascades.

The legal logic invoked was the "public policy" exception in Brussels I bis — Article 45(1)(a) — which allows a member state to refuse enforcement of foreign judgments that contradict its fundamental legal principles. Malta argued that protecting its licensed gaming operators from extraterritorial enforcement was a matter of national public policy.

That argument is now in serious trouble.

2. What the AG Opinion Actually Says

The opinion came out of case C-683/24, referred to the CJEU from an Austrian court. The case itself focused on whether a lawyer providing legal advice on Bill 55 had engaged in professional liability. The validity of Bill 55 was a preliminary question.

AG Emiliou's opinion broke down into several conclusions, each of them damaging for the Maltese position:

Article 56A is incompatible with Brussels I bis. The AG found that Article 56A creates a categorical, abstract refusal mechanism that operates as a wholesale exemption rather than a genuine public policy assessment. Brussels I bis requires public policy refusals to be applied case-by-case, with reference to specific judgments. Article 56A doesn't do this — it issues a blanket refusal for an entire category of cases. That isn't how the public policy exception works.

Economic consequences don't justify public policy invocation. The opinion is explicit on this point: "The fact that the enforcement of certain judgments may entail serious economic consequences for a national operator, an industry or even the Member State addressed does not justify recourse to the 'public policy' clause." Malta's industry-protection argument was directly addressed and rejected.

Maltese gaming licences are valid only in Malta. The opinion reaffirmed what the April 16 CJEU ruling had already established — under current EU law, member states are not obliged to recognise gambling licences issued by other member states. Each member state retains the right to regulate gambling within its own territory.

The AG opinion isn't legally binding. The CJEU judges may agree, partially agree, or reject the opinion. According to published analyses, the CJEU follows AG opinions in approximately 70% of cases. In high-profile cases involving fundamental EU law principles, that rate is higher.

What's more telling is the broader trend. The European Commission has opened infringement proceedings against Malta. The German GGL, Austrian regulators, French, Italian, Spanish, Portuguese and UK regulators have publicly aligned in pushing for stronger cross-border enforcement. The political and legal momentum is unmistakeably against Malta's position.

3. The Three Possible Scenarios

When the CJEU rules — likely in the second half of 2026 — there are three plausible outcomes. Operators should be modelling all three.

Scenario A: Full Strike-Down (probability: high)

The CJEU follows the AG opinion and declares Article 56A incompatible with EU law. Malta is required to repeal or substantially amend the provision. Foreign judgments against MGA-licensed operators must be recognised and enforced in Malta.

Implications:

• Player refund claims from Germany, Austria, and other markets become enforceable
• Operators face potentially hundreds of millions in liability across the sector
• The MGA licence loses its function as a cross-border passport
• Operators serving regulated EU markets without local licences face direct legal exposure

Operator response: Accelerated migration to local licensing in target markets, exit from markets without locally regulated frameworks, or shift to less-exposed jurisdictions for non-EU operations.

Scenario B: Partial Strike-Down (probability: medium)

The CJEU finds Article 56A incompatible in its current form but provides Malta a pathway to amend the provision. Maltese courts are required to apply public policy refusals on a case-by-case basis rather than categorically. Some claims succeed, others fail, depending on facts.

Implications:

• Sustained legal uncertainty for 12-24 months
• Increased compliance costs for case-by-case analysis
• Players continue litigating but face higher procedural barriers
• The MGA licence retains some cross-border value but with significantly reduced certainty

Operator response: Hybrid strategy — maintain MGA for some markets, secure local licences in highest-exposure markets (Germany, Austria, Netherlands).

Scenario C: Procedural Inadmissibility (probability: low-medium)

The CJEU adopts the AG's procedural recommendation that the Austrian referral was inadmissible because the underlying case did not require ruling on Bill 55's validity. The substantive question is deferred to a future case.

Implications:

• Status quo for 12-18 months
• Other cases winding through national courts to CJEU
• Pressure continues to build but no immediate decision
• Operators get more time to prepare but face increasing political pressure

Operator response: Use the breathing room to plan migration, but don't assume the issue is resolved.

The risk weighting matters. Even if Scenario C plays out, the underlying legal trend is unambiguous. Malta will eventually face a definitive ruling. Operators planning for "Bill 55 will hold" are planning for the lowest-probability outcome.

4. Who Is Most Exposed

So where does your operation fall?

Not all MGA-licensed operators face equal risk. Exposure varies based on three factors.

Player Geography Concentration

Operators with significant player volume from Austria, Germany, Netherlands, or France are most exposed. These are the jurisdictions where successful player refund claims originated and where domestic regulators have been most aggressive about challenging Maltese cross-border operations.

Operators primarily serving non-EU markets (LATAM, Asia, Africa) under MGA licences face less immediate exposure but still need to plan — the MGA's reputational standing affects payment processor relationships and banking globally.

Historical Operations Without Local Licences

The retroactive nature of player refund claims is the largest single risk factor. If you operated in Germany, Austria, or Netherlands during the period when local licensing existed but you didn't hold a local licence, every player loss is potentially claimable.

Some operators voluntarily exited these markets in 2020-2023 when local frameworks emerged. Others continued operating under the MGA passport theory. The latter group has years of accumulated potential liability.

Capital Reserves and Banking

A judgment is only meaningful if it can be enforced. The CJEU has signalled that EU enforcement tools — including the European Account Preservation Order (EAPO) — could be used to freeze assets of Malta-based operators in cross-border disputes, even where Maltese courts refuse enforcement.

Operators with significant assets outside Malta — banking relationships in Cyprus, Estonia, Germany, payment processor accounts in third-party jurisdictions — face higher enforcement risk than operators with assets concentrated in Malta.

Public Profile

Higher-profile operators are more likely to attract litigation. Boutique operators serving narrow markets may continue operating in regulatory uncertainty longer. Major brands face direct claims from organised player advocacy groups (Spielerschutz organisations in Austria and Germany have built specialised practices around these claims).

5. Pre-Emptive Jurisdictional Planning

The strategic decision facing every MGA-licensed operator is: jurisdictional concentration or jurisdictional spread?

Option 1: Local Licensing in Priority Markets

The most defensive approach. Acquire local licences in the markets you currently serve under MGA passport theory.

Markets requiring serious consideration:

Costs estimated based on publicly available data.

The math is brutal. Acquiring all six EU regulated licences runs €1.55M–€3.2M in year one and 6-10 months of compliance work. Few operators can absorb that timeline.

The phased approach: prioritise based on player volume. The market generating most of your GGR gets the first local licence. The next two markets follow within 6 months. Lower-volume markets either get later licences or are exited.

Option 2: Geographic Refocus

The alternative is to exit regulated EU markets entirely and concentrate on unregulated markets where MGA licensing remains functional. LATAM, parts of Asia (excluding India post-PROGA), Africa, parts of Eastern Europe (excluding regulated markets).

This is the right path for operators whose EU player volume is small enough that exit cost is recoverable through focus elsewhere. The downside: it sacrifices the European market segment that has historically been the most lucrative.

Option 3: Hybrid via Strategic Acquisitions

Mid-tier operators are increasingly looking at acquiring already-licensed operators in priority markets rather than going through licensing from scratch. The valuation premium for German, Dutch, or French licensed operators has reportedly risen 20-40% in 2026 specifically because of Bill 55 risk.

If you have €5M+ of acquisition capacity and a clear target market, buying an existing operator with active local licensing may be faster than 9 months of GGL application.

Option 4: Wait and Hope

The temptation is real. CJEU rulings take time. Player refund claims are slow to litigate. Maybe the issue resolves favourably.

This is the riskiest path. Even in the best-case scenario for operators, the legal environment is now significantly more challenging than it was 12 months ago. Banking partners are tightening MGA-only operator due diligence. Payment processors are reassessing onboarding criteria. Insurance underwriters for D&O coverage are repricing MGA-licensed operator policies.

Even if Bill 55 holds, the trend is moving in one direction.

6. Timeline and What to Watch

April-May 2026

AG opinion published. Initial industry assessment. EC infringement proceedings continue.

June-September 2026

CJEU deliberation period. Additional cases potentially referred to CJEU from German and Austrian courts. Continuing player refund litigation in national courts.

October-December 2026

Likely CJEU ruling window for case C-683/24. Even if this case is ruled inadmissible, related cases pending CJEU referral may proceed.

Q1 2027

If CJEU rules against Malta, implementation period begins. Malta has typically been given 6-12 months to amend domestic legislation. Operators face hard decisions about ongoing operations.

Q2-Q4 2027

Full impact of CJEU ruling realised. Player refund claims accelerate. Banking and payment processor reassessment of MGA-only operators. Major operator restructuring or exits visible.

What to monitor:

1. Additional CJEU referrals — if multiple cases reach CJEU simultaneously, ruling may be consolidated, potentially earlier
2. EC infringement proceeding progress — first formal EC actions against Malta
3. Major operator announcements — exits, local licensing applications, strategic shifts
4. Banking and payment processor policy updates — Tier-1 banks tightening MGA-only operator due diligence
5. MGA response — whether Malta proposes Article 56A amendments pre-emptively
6. Insurance market — D&O coverage repricing for MGA-licensed operator boards

7. Operational Decisions for the Next 90 Days

This is the time-sensitive part. Don't wait for the ruling. Six concrete actions every MGA-licensed operator should be taking now, regardless of which scenario plays out.

Action 1: Calculate Your EU Exposure

Run a rigorous analysis of player losses by jurisdiction over the past 5 years. Focus on Germany, Austria, Netherlands, Spain, France, Italy. Calculate total potential refund liability if all players claimed. This is your worst-case downside.

This number is uncomfortable to look at, but you can't make rational decisions without it.

Action 2: Brief Your Board

Most operator boards are not yet aware of the magnitude of Bill 55 risk. Prepare a board-level briefing covering: AG opinion summary, exposure calculation, scenario analysis, capital implications, strategic options. This is a fiduciary obligation — boards can't govern responsibly without understanding the risk.

Action 3: Strengthen Banking Relationships

Diversify banking relationships beyond Maltese institutions. Open accounts in jurisdictions where you may need to operate independently of MGA. Ensure key operational accounts are not concentrated in one jurisdiction that may face freezing under EAPO.

Action 4: Document Compliance Where You Operated

If you operated in markets without local licences during 2018-2024, document your compliance posture for that period — KYC procedures, AML protocols, responsible gambling measures. This documentation may be essential in defending claims if and when they come.

Action 5: Engage Specialised EU Gaming Counsel

Most gaming lawyers focus on regulatory compliance. Bill 55 is fundamentally a Brussels I bis enforcement question — that's a different specialisation. Identify counsel with EU enforcement law expertise, not just gaming licensing expertise.

Action 6: Begin Local Licensing Diligence

Even if you don't apply yet, complete the diligence on local licensing in your top 2-3 EU markets. Use a go-live checklist to structure your preparation. Understand cost, timeline, technical requirements, capital requirements. Have the application package ready to submit if scenario A or B materialises.

8. What Comes After Malta

What comes after the Malta passport era?

The longer-term question is whether the European online gambling industry settles into a fully jurisdiction-by-jurisdiction model or whether new pan-European frameworks emerge.

The political momentum is clearly toward jurisdictional fragmentation. Each major EU member state has built its own regulatory framework. National regulators have aligned in coordinated enforcement against unlicensed cross-border operators. The European Commission has shown no appetite for harmonised pan-European gambling regulation — gambling remains a member state competence under EU treaties.

The economic implication for operators: significantly higher compliance costs, smaller addressable markets per licence, but also higher barriers to entry. This favours larger, well-capitalised operators who can absorb licensing costs across multiple markets and disadvantages smaller operators who built businesses on the MGA passport assumption.

A reasonable forecast for 2027-2028:

• Tier-1 operators (€100M+ GGR): Multi-jurisdictional licensing across 5-8 EU markets. MGA retained for non-EU operations. Premium valuations.

• Tier-2 operators (€20-100M GGR): Strategic acquisitions or sales. Concentration on 2-3 priority markets with local licensing. Some exit EU entirely.

• Tier-3 operators (under €20M GGR): Most exit EU regulated markets. Refocus on LATAM, Africa, Asia under MGA or alternative licences (Nevis, Curaçao).

• MGA itself: May reposition toward a global operations-focused licence model. Cost structure may need to come down to remain competitive against Nevis.

The Malta licensing era is ending. What replaces it will be more expensive, more fragmented, and more rigorous. Operators who start planning now will navigate the transition. Operators who wait for clarity will be making decisions in crisis mode.