Does Supplying Gaming Operators Make My Cyprus Company Regulated?

Why suppliers are being asked this now

Two Maltese legal notices took effect on 1 October 2026. Legal Notice 86 of 2026 narrowed the value added tax exemption for gambling, and Legal Notice 84 of 2026 replaced the gaming tax structure. Operators are reassessing what they buy, from whom, and on what basis.

The questions are landing on suppliers. A company writing software, hosting infrastructure, verifying identities or supplying content to a gaming operator is being asked to confirm where it sits, and the answer is less obvious than it looks.

A supplier can be inside the gaming framework without ever taking a bet, holding player funds or dealing with a player.

The Third Schedule, which is the part founders do not expect

Malta's Gaming Authorisations Regulations divide business to business activity in two.

A critical gaming supply requires a Critical Gaming Supply licence. Regulation 3(1) provides that no person shall provide or carry out a gaming service or provide a critical gaming supply from Malta or to any person in Malta, or through a Maltese legal entity, except with a valid licence or an exemption. The reference to a Maltese legal entity matters, because it reaches a supply routed through a Maltese company irrespective of where the work is done.

A material gaming supply is listed in the Third Schedule. The list includes:

• manufacturing, placing on the market, distributing, supplying, leasing or transferring a gaming device
• providing risk management services for the operation of a licensable game
• providing event, content and, or odds
• providing fraud management services for the operation of a licensable game
• holding and, or managing player funds
• providing services relating to customer due diligence
• providing services related to player identity verification
• providing co-location services and other managed information technology services, including cloud computing services and, or decentralised hosting protocols, where these do not amount to a critical gaming supply

The last four are the ones that catch people. A compliance software vendor, an identity verification provider, a fraud scoring service or a hosting business can be supplying a material gaming supply while regarding itself as an ordinary technology company.

Why the customer asks, and why a certificate is commercial rather than compulsory

A material gaming supplier may request a material gaming supply certificate under regulation 20(1). It is not required to hold one.

Regulation 20(2) is where the pressure comes from. An authorised person making use of a material gaming supply must ensure either that the supplier holds the certificate, or that the supply is otherwise approved by the Authority on a case by case basis. Where an authorised person receives material gaming supplies from a third party who holds no certificate, that authorised person assumes full regulatory responsibility for those supplies.

So the operator carries the supplier's regulatory risk. That is the reason an uncertified supplier finds the question raised in procurement, in renewal negotiations and in diligence, and it is a commercial consideration rather than a legal obligation on the supplier itself.

What changed on 1 October, and what it means for a supplier's pricing

Two changes run in opposite directions for a supplier, and neither is a new charge on the supplier.

Gaming tax does not reach a business to business supplier. Under the substituted regulation 3(1) of the Gaming Tax Regulations, gaming tax is payable by a person offering a gaming service to a player. A supplier of content, platform or services to an operator is not doing that. The rates introduced on 1 October, being 15 percent on Type 1 services, 10 percent on Types 2, 3 and 4, and 5 percent within controlled gaming premises or for junkets, apply to the operator.

Your customer's recoverable cost base changed. Part Two of the Fifth Schedule to the Maltese VAT Act is headed exemptions without credit, so a supply inside it carries no right to deduct input tax. Narrowing item 9 moved a range of gambling supplies into the taxable column, and the Malta Tax and Customs Administration described the consequence as a natural right of recovery of eligible input tax.

For a supplier, the practical effect is that an operator who previously could not deduct the tax on your invoice may now be able to. The net cost of the same fee to that customer can fall, which is a fact worth knowing before a renewal conversation rather than after one.

Malta is not the only perimeter, and the others are drawn elsewhere

A supplier that has settled its Malta position has answered one question in one market. Four other regimes license business to business supply directly, and none of them draws the line where Malta draws it.

Sweden

Chapter 11 of the Gaming Act, spellagen (2018:1138), has required a permit since 1 July 2023 for anyone who manufactures, supplies, installs or modifies game software used in the online gambling covered by chapters 7 and 8. The requirement was introduced through proposition 2021/22:242.

It reaches down the chain. The Swedish Gambling Authority's published position is that the requirement applies whether the company is a manufacturer or a subcontractor, and that a permit is also needed where a supply agreement is entered into with a licence holder on the Swedish market. The test it applies is who controls the design and content of the software and who owns it.

Software written for supporting activities, which the authority gives as results analysis, affiliate operations and customer management, sits outside.

Denmark

Since 1 January 2025 a game supplier must hold a licence from Spillemyndigheden in order to supply betting and online casino licence holders. The authority states that the supply of games is to be understood broadly, and that it covers suppliers of casino games such as slots or roulette as well as suppliers of services that operate and settle bets. The games, platform, business procedures and systems must be tested by an accredited certification body before a licence is issued, so the gate is reached well before the application is.

Romania

Romania licenses by class. Class I is the operator licence, held by the business that takes the player's bet. Class II is the business to business licence, and it is the one a supplier needs.

Under Government Emergency Ordinance 77/2009 the Class II category takes in the production and distribution of specialised gambling software, platform hosting and management, payment processing, affiliates, conformity assessment bodies and auditors.

Ontario

Registration as a gaming-related supplier arises under the Gaming Control Act, 1992 and Ontario Regulation 78/12. The category reaches a person who manufactures, provides, installs, tests, maintains or repairs gaming equipment, or who provides consulting or similar services directly related to the playing of a lottery scheme or the operation of a gaming site. Platform providers, game developers, customer electronic wallet providers, odds makers, sports integrity monitoring organisations and independent test laboratories are registrable.

This is where the perimeter visibly moves. The Alcohol and Gaming Commission of Ontario treats internet service providers and cloud services as non-gaming-related, together with payment processing other than wallet functions. Malta's Third Schedule expressly includes co-location and other managed information technology services including cloud computing.

Two of these regimes make the supplier police its customer

Sweden and Romania do something Malta does not. They put the operator's licensing status onto the supplier.

In Sweden the holder of a game software permit is prohibited from working with a party that lacks the licence that party needs.

Romania went further, and did so recently. Law 141/2025, published in Monitorul Oficial 699 of 25 July 2025, amended Ordinance 77/2009 so that a Class II licensee may not provide services to internet entities or domains offering remote gambling that can be accessed from Romanian IP addresses, unless that operator holds a valid Class I licence and the authorisations issued by the regulator.

The same law requires a Class II licensee that produces or distributes software, provides management facilities or processes payments to implement technical means of establishing where a participant actually is, independently of the information provided through the gaming platform integration.

That requirement answers a question suppliers normally treat as their customer's. It cannot be satisfied by relying on the operator's assurance about geo-blocking, because the obligation is to determine the player's real location by the supplier's own means.

So for a Cyprus company the operative question is not only whether it is regulated. It is where the players are. A supply that is unremarkable when players sit in one market can be prohibited when they sit in another, and in Romania the supplier is required to find that out for itself rather than take it on trust.

The Cyprus side, which is where the company actually sits

Three questions arise for a Cyprus company supplying gaming operators, and none of them is answered by the Maltese position.

Whether the supply is taxable or exempt for Cyprus value added tax. Table B of the Seventh Schedule to the VAT Law N.95(I)/2000 exempts the supply of lottery tickets and horse racing or football pools coupons, the acceptance of bets and other games of chance. It is an exemption without credit. Ordinary business to business services supplied to a taxable customer are not within it, but where any part of a company's activity is characterised as the acceptance of bets or the conduct of a game of chance, input tax attributable to that part is not deductible and a partial attribution method is required.

Registration, including on what the company buys. Article 11 deems the recipient of services from abroad to have made the supply, and its value counts towards the ordinary 15,600 euro threshold in any twelve consecutive months. A company buying platform, hosting or compliance services from outside Cyprus can become registrable on its purchases while selling nothing locally.

Whether any part of the activity touches players located in Cyprus. This is the question to settle first, because the answer is not commercial. Article 84 of the Betting Law 37(I)/2019 makes it a felony to provide services for the conduct in the Republic of online casino games of chance, carrying up to five years imprisonment or a fine of up to 300,000 euro, or both. Articles 85 and 86 prohibit betting exchanges and spread betting on the same terms.

Chance, skill, and who has to prove which

Suppliers building competitive or prize based features often assume a product is a skill game and therefore outside the framework. Malta places that burden the other way.

Regulation 7 of S.L. 583.05 vests the Authority with sole discretion to classify an activity as a game of chance, a game of skill or otherwise, on the considerations listed in the Sixth Schedule, after taking into account submissions from the operator or promoter and any research or publication from an authoritative source. The burden of proving that an activity is a skill game rests at all times on the party operating or promoting it. Regulation 8 allows the Authority to rule that a game is a controlled skill game.

The Sixth Schedule considerations begin with the presence of random draws and their effect on the outcome, and whether the game is played for money or prizes with a monetary value.

Two details are worth holding alongside that. Type 1 gaming services expressly include virtual sports games, so a simulated event is treated as a game of chance rather than as a sporting event. And the Cyprus definition of a bet reaches only events in which natural persons participate and which actually take place, so a simulated event is outside what Cyprus licenses at all.

One question the statutes leave open

Paragraph 5 of Table B refers to the acceptance of bets and other games of chance without distinguishing by medium. Silence on medium is not confirmation that remote supplies fall inside it. No Cyprus circular or decided case settling the point has been identified, and commentary asserting that the exemption applies to bets supplied electronically has not been traced to an instrument.

It is left open here rather than answered. A value added tax position taken on an untested reading is a position that has to be defended later, and where the underlying activity is in any event prohibited, the treatment does not arise.