On 22 October 2026, the Dutch gambling regulator announced a record fine of €37.25 million against EOD Code SRL. EOD Code operates Instant Casino and eleven other gambling websites. The penalty exceeds every previous fine for an unlicensed gambling offer. It also follows the fifth anniversary of legal online gambling in the Netherlands. Days earlier, the regulator’s chairman had acknowledged that fines send a clear signal but achieve little when it comes to collection.
The fine concerns offering gambling without a licence under Article 1(1)(a) of the Betting and Gaming Act (Wok). Investigators also identified promotional channels directing Dutch players towards EOD Code’s websites. These included influencers and a Dutch-language promotional site, which helped establish that the operator targeted Dutch consumers. Dutch law separately prohibits promoting unlicensed gambling, bringing affiliates within the regulator’s enforcement remit. The Kansspelautoriteit (Ksa) also documented how it calculated the penalty without receiving financial information from the operator.
The Kansspelautoriteit fine against Instant Casino
Dated 6 October 2026, the seventeen-page decision describes the investigation and the evidence supporting the penalty. It also records how the Ksa proceeded despite receiving no response from EOD Code.
Twelve websites, one Costa Rican licence claim
Investigators examined instantcasino.com for the first time on 19 November 2024. Using Dutch registration details, they opened an account, deposited €20 in Bitcoin and placed bets without encountering technical restrictions. Four subsequent checks produced similar results. On 29 July 2025, the Ksa issued an order subject to periodic penalty payments against EOD Code. A further inspection in July 2026 found that Dutch players could still register through the mirror domain instantcasino17.com.
During 2026, investigators connected eleven additional domains to EOD Code, including skyhills.com, goldenpanda.com and luckypays.io. The websites claimed registration and regulation in Costa Rica. They also designated courts in Curaçao for dispute resolution. However, these claims did not establish authorisation to offer gambling services in the Netherlands.
Several website features indicated that EOD Code actively accommodated Dutch customers. According to the published fine decision, registration forms automatically selected “The Netherlands” and entered the +31 dialling code. Depending on the site, payment options included iDEAL, ING, Rabobank or ABN AMRO. Parts of the checkout process also appeared in Dutch. Furthermore, customer support responded in Dutch, while Google search data showed frequent searches for the brand from the Netherlands.
Search data instead of turnover figures
In May 2026, the regulator requested financial information from EOD Code but received no response. The company then missed the deadline for commenting on the draft decision. Without those figures, the Ksa applied its published search volume method to estimate revenue. This approach uses searches for gambling brands to calculate approximate gross gaming revenue. The resulting estimate put Dutch revenue for 2025 at roughly €108.4 million and worldwide revenue at almost €373 million.
The 2026 fine policy for illegal remote gambling sets the base penalty for this revenue band at 100% of Dutch gross gaming revenue. Aggravating circumstances increased that percentage by another 170 percentage points. The calculation therefore produced a fine of €292.6 million. However, Article 35a of the Betting and Gaming Act (Wok) limits fines to 10% of worldwide turnover in the previous year. Applying that statutory ceiling, the Ksa set the final penalty at €37.25 million.
| Aggravating factor found by the Ksa | Increase (percentage points) |
|---|---|
| No visible age verification before registration | 50 |
| Prohibited types of bets on offer | 20 |
| Inactivity fee of €5 a month from the thirteenth month | 10 |
| Autoplay or turbo play | 10 |
| Missing or pre-filled play limits | 10 |
| Minimum deposit amounts | 10 |
| Deposits in cryptocurrency | 10 |
| Unfair terms, including keeping a player’s balance after permanent self-exclusion | 50 |
| Total increase on top of the 100% base fine | 170 |
Illegal gambling in the Netherlands five years after legalisation
The Dutch online gambling market opened on 1 October 2021 under the Remote Gambling Act (Wet Koa). Five years later, the first licence holders are entering a new licensing period. Meanwhile, the illegal market continues to account for a substantial share of gambling expenditure.
Follow-up licences under closer scrutiny
The initial licences from 2021 reached their expiry date at the end of September 2026. Ahead of that deadline, the Ksa issued the first eight follow-up licences on 17 September. These licences run from October 2026 until September 2031. Holland Casino Online, TOTO and Bet365 are among the holders.
During this renewal process, the regulator examined applicants’ compliance records over the preceding five years. For the first time, its assessment explicitly covered every established violation during that period. Applicants had to explain the corrective measures they had taken and their arrangements for preventing similar breaches. In addition, some licence holders received specific points of attention alongside their renewed authorisation.
One illegal euro for every legal one
In a column marking the anniversary, Ksa chairman Michel Groothuizen discussed the difference between player participation and gambling expenditure. Surveys consistently indicate that approximately 90% of Dutch online gamblers use licensed operators exclusively. However, financial estimates present a different distribution. For every euro staked through licensed gambling services, another euro reaches the illegal market.
Groothuizen also addressed the difficulties of collecting fines from unlicensed operators. Although penalties communicate the regulator’s position, collection has achieved limited results. Over the past eighteen months, the Ksa has therefore pursued additional enforcement measures. These include making illegal websites harder to find and disrupting the payment channels supporting them.
The EOD Code investigation provides an example of the collection difficulties. In December 2025, the regulator had already begun collecting forfeited penalty payments from the company. Nevertheless, its gambling websites remained accessible. EOD Code may still object to the new fine, although an objection does not suspend the decision. Whether the regulator will ultimately collect the €37.25 million remains uncertain.
Illegal gambling in the Netherlands and the affiliate chain
Article 1(1)(b) of the Wok extends the prohibition beyond gambling operators to those promoting participation in unlicensed gambling. The Council of State confirmed that advertising for such operators falls within this provision. As a result, affiliates can face enforcement action for promoting illegal gambling in the Netherlands. Article 35a also permits administrative fines for violations of the promotion ban, alongside penalty orders.
Influencers and promotional sites in the EOD Code file
Investigators found a Dutch-language website promoting Instant Casino. Several Dutch influencers also directed followers on Instagram, YouTube and Discord to skyhills.com through direct links. Meanwhile, TikTok videos displayed the Skyhills logo alongside Dutch captions. Four influencers had already received Ksa penalty orders in June and September 2025.
The regulator included these promotional activities among the evidence that EOD Code targeted Dutch consumers. Separately, the advertising channels themselves may fall within the statutory prohibition on promoting unlicensed gambling. The Ksa’s supervisory agenda for 2026 identifies influencers and illegal affiliate websites as enforcement priorities. It also describes a stricter approach to these promotional activities. During 2025, cooperation with SIDN, the registry for .nl domains, had already made several illegal affiliate websites unreachable.
The regulator has also taken action involving hosting providers. In an earlier investigation, it could not establish who owned an affiliate website advertising unlicensed casinos. For that reason, the Ksa issued a binding instruction to DigitalOcean, which hosted the website. The instruction required the hosting provider to take action in the absence of an identifiable website owner.
Cloned licensee sites on .co.nl domains
Another enforcement issue concerns websites that imitate licensed gambling operators. These sites reproduce the appearance of authorised brands under .co.nl domains rather than .nl addresses. Visitors then encounter redirects to unlicensed casinos. In early October, the Ksa reported that it had had 26 of these clones removed within 48 hours each. Almost all impersonated licensed operators. The regulator has so far reported 86 websites to the .co.nl operator, resulting in their removal.
Affiliates need to distinguish between an authorised gambling brand and the specific domain receiving their traffic. A familiar brand name alone cannot establish whether a website holds a Dutch licence. Numbered mirrors, alternative extensions and outdated redirects may lead visitors to unlicensed gambling services. Links can also continue directing traffic after the original destination changes.
Payments and Big Tech as the second enforcement track
Groothuizen’s anniversary column describes discussions between gambling regulators and major technology platforms. Last spring, the Ksa joined several European regulators for meetings with Google and Meta at their European headquarters in Dublin. Both sides knew that litigation was the alternative to cooperation. Since then, a joint task force has worked with Google on a white list of licensed EU gambling operators. Under the proposed approach, Google could refuse operators absent from that list because their absence would indicate a breach.
Political discussions have also addressed the responsibilities of large online platforms. During a September committee debate, VVD member of parliament Bart Bikkers urged the Ksa to fine major technology companies directly. Groothuizen did not exclude that possibility. However, he cautioned that proceedings could take five years before reaching a final judgment. Under the Digital Services Act, sanctions against those platforms are a matter for the European Commission, so the Ksa can only supply evidence.
Payment restrictions form another part of the regulator’s enforcement activities. In its EOD Code announcement, the Ksa refers to cooperation with payment service providers, hosting companies, banks and major technology firms. A future Google white list could also affect advertising visibility for affiliates promoting brands outside the approved register. Such an effect would depend on how Google implements the arrangement. The regulator has not announced a specific plan to restrict affiliate advertising through this mechanism.
What Dutch affiliates should check now
The enforcement measures described above do not introduce new statutory obligations. However, they identify several existing compliance risks for affiliates targeting Dutch consumers. Website operators can review their promotional activities against the following points:
- Every promoted brand appears in the Ksa’s Kansspelwijzer, under the exact domain the site links to.
- No links point to numbered mirrors, alternative extensions or .co.nl lookalikes of licensed brands.
- Promotions avoid role models, including influencers and streamers, since that ban applies to licensed operators too.
- Reviews of offshore brands that accept Dutch players, crypto deposits or iDEAL without a licence are removed rather than reworded.
- Tracking links and redirects are checked regularly, because a destination can change after publication.
Regular checks of outbound links are particularly relevant when operators change domains or redirect traffic. The EOD Code investigation involved repeated inspections over almost two years before the Ksa imposed its fine. During that period, the regulator continued documenting access to the websites. An affiliate maintaining links to those destinations could then appear in evidence concerning the promotion of unlicensed gambling.
How QMRA reviews Dutch affiliate sites
Our legal team assesses Dutch affiliate websites against the Wok, the Remote Gambling Act and the Ksa’s advertising requirements. Each promoted operator undergoes a licence check covering the specific domain advertised. We also examine bonus descriptions, 18+ warnings and references to Cruks and responsible gambling support. In addition, our reviews cover the use of role models in promotional material.
Certification for the Dutch market takes place through the Keurmerk Verantwoorde Affiliates (KVA). The active markets page lists the jurisdictions QMRA covers, while our affiliate members page identifies certified websites. Information about the assessment procedure appears in How does it work. Further details about affiliate marketing arrangements are available in Gambling Affiliation: How does it work?
Frequently asked questions
How large is the Kansspelautoriteit fine against EOD Code?
The Ksa fined EOD Code SRL €37,250,000 in a decision dated 6 October 2026. It is the highest fine the regulator has imposed for an unlicensed gambling offer so far. Without the statutory cap of 10% of worldwide turnover, the calculated fine would have been €292.6 million.
Which websites were covered by the decision?
The investigation started with instantcasino.com and its mirror instantcasino17.com. After that, the Ksa linked eleven more sites to EOD Code: skyhills.com, slotmonster.com, betiro.com, betblast.com, fastslots.com, goldenpanda.com, sambaslots.com, winningz.com, incognitocasino.com, foxygold.com and luckypays.io.
Can an affiliate be fined for promoting illegal gambling in the Netherlands?
Yes. Article 1(1)(b) of the Betting and Gaming Act prohibits promoting participation in unlicensed gambling. The Council of State has confirmed that advertising falls within that ban. On top of penalty orders, Article 35a allows the Ksa to impose administrative fines for this violation.
How did the Ksa calculate the fine without company data?
EOD Code ignored a data request, so the Ksa used its published search volume method. It estimated Dutch gross gaming revenue for 2025 at about €108.4 million and worldwide revenue at about €373 million. The fine was then capped at 10% of that worldwide figure.
How can affiliates check whether an operator holds a Dutch licence?
The Ksa publishes all licence holders in its Kansspelwijzer. Affiliates should check the exact domain they link to, not only the brand name. Mirror domains, numbered variants and .co.nl lookalikes do not share the licence of the original site.
