What changed on the rails.

Brazil's freeze mechanism becomes operational in three weeks.

CMN Resolution 5.320/2026 enters into force, operationalising the June decree that lets the regulator order banks to freeze an unlicensed operator's accounts within 24 hours. A 24-hour freeze needs a named account, and the account is not in the operator's name.

Italy blocks 190 more gambling domains. The list now runs past 12,600.

ADM's latest inhibition decree took the cumulative blacklist to roughly 12,638 domains, with ISP compliance due 20 August. Blocking a domain does not touch the merchant account behind it — the operator re-registers, and the payment relationship survives.

Mastercard's scam-merchant programme is now enforceable. Acquirers have 72 hours.

Acquirers must investigate any merchant flagged for scam signals — combined refund and chargeback rate above 5%, a sharp authorisation-rate drop, multi-issuer fraud reports — within 72 hours, and terminate confirmed cases immediately. Seventy-two hours is not enough time to find out who is behind a cloaked merchant unless somebody has already bought from it.

Sweden's regulator reports supervision cases against payment intermediaries.

Spelinspektionen's Q2 report describes continuing cases against payment intermediaries facilitating transactions to and from unlicensed operators. Swedish PSPs now sit under dual supervision by the gambling regulator and the financial supervisor.

AMLA moves toward direct supervision of payment firms.

The EU anti-money-laundering authority published its final report on supervisory-cooperation standards for direct supervision, and has since begun surveying payment institutions and EMIs on the Central Contact Point framework. Direct supervision arrives with an expectation that an institution knows who its merchants actually are.

France orders ISPs to block a prediction market for illegal gambling promotion.

ANJ ordered French ISPs to block the site after an earlier formal notice was circumvented — the operator had geoblocked French financial transactions, and users routed around it. Blocking the domain and blocking the money are different problems, and only one of them was solved.

A supplier pays £4.75m for what its customers did on the black market.

The Gambling Commission settled a nineteen-month investigation into a games supplier whose products were reachable through unlicensed casinos serving UK consumers. Liability is moving down the stack, from operator to supplier — the payment layer is the next rung.

Greece wires its gambling regulator directly into the national DNS.

EEEP and the telecoms regulator agreed a response-policy zone for faster domain blocking, weekly reporting of new .gr registrations, and mandatory two-month non-re-registration of implicated domains. The government puts the local black market at roughly €2bn a year.

A trade association ran test transactions, then filed a complaint with a financial regulator.

A European licensed-operator body investigated illegal gambling sites, made test payments to establish who was processing for them, and took the result to a national financial regulator. It worked — and it took an industry association to do it, because nobody inside the payment networks was doing it at scale.

We do not name the payment provider. The company has publicly denied the allegation, and we do not repeat unproven claims about licensed institutions.

Italy adds 293 domains in a single decree.

The July inhibition decree took the cumulative list to 12,448, with ISP compliance due 27 July. Three weeks later another 190 followed.

Two estimates of the same market, five times apart.

The European Casino Association and Gambling Compliance International put illegal online gambling GGR targeting EU consumers at €91.6bn for 2025, up around 14%, with more than 6,200 operators active. EGBA's own March estimate is roughly €18bn, or 27% of EU online GGR — both cannot be right, and nobody has ground truth.

The associated €22.9bn tax figure is derived by applying an assumed 25% tax rate to the GGR estimate. It is not an observed tax gap.

Germany's regulator confirms payment blocking as a standing instrument.

The GGL's 2025 activity report lists Zahlungsblockierung alongside prohibition orders and network blocking as an active enforcement tool. Payment blocking is now normal practice in the largest EU market, which makes identification the binding constraint — not legal authority.

“It can appear as though the cardholder is buying beauty products.”

Sweden's gambling regulator, in a published situational report, describes card payments for gambling arriving miscoded as retail. The consequence it states plainly: payment service providers cannot see what they are processing, and so cannot refuse the transaction as the law requires.