Germany online gambling: GGL permissions and product scope

Why does product classification matter?

The GGL publishes separate guidance for online poker and virtual slot games and an overview of permissible internet gambling categories. Its whitelist also includes permissions supervised by other German authorities.

Create a product catalogue using regulatory categories, not just the names used by a platform vendor. For example, a website menu headed “casino” may contain products that raise different permission questions. Classify each intended vertical and record the authority responsible.

How should the whitelist be used?

The official whitelist is a verification source for authorised providers and their permitted categories. Match the legal entity and activity rather than treating the presence of a related brand as permission for the whole corporate group.

During supplier due diligence, save a dated record of the verification and resolve discrepancies. If an entity is licensed for one activity, do not infer that a different activity or domain is covered. The register check complements examination of the actual regulatory documents.

What belongs in the application preparation?

Use the GGL’s current provider download area and the materials for the selected activity. The authority’s guidance addresses reliability and operational concepts, including areas such as business viability, player protection, IT security, payments and money laundering.

Turn those areas into connected workstreams. A payment concept should match the customer journey and the forecast; a player-protection concept should match the system settings and staff responsibilities. Generic policies copied from another jurisdiction can miss German-specific implementation requirements.

What is a useful technical readiness exercise?

Build a requirements-to-evidence table for the applicable framework. Record the requirement, system component, configuration owner, test case and evidence location. Include the relevant central-system interfaces and exclusion controls where required by the selected permission.

• Test product availability against the permitted category.
• Check account restrictions across registration, play and marketing.
• Verify the responsible team can retrieve regulatory records.
• Trace an exception from detection to resolution.
• Record which documents and tests must be repeated after a material change.

How should launch scope be approved?

Make the final decision against the issued permission and completed operational evidence, not against the date the application was filed. Reconcile the entity, domains, products and suppliers across the project.

An existing Malta or other foreign licence should not be presented as German permission. Where a particular product or business model raises a disputed legal issue, isolate that issue for specific advice. Keep the public website and commercial forecasts within the scope that has actually been cleared for launch.