Why an EU License Doesn’t Guarantee Cross-Border Access (and what it means for Operators)

When analyzing the recent CJEU preliminary ruling in Case C-440/23, it is vital to keep a specific nuance in mind. This case did not seek to definitively answer whether the player’s action would be successful- i.e., whether the player would automatically recover the stakes they lost between 2019 and 2021.

Rather, the core question was whether EU law permits a Member State (in this case, Germany) to enforce a prohibition on online gambling services against a company that is validly licensed in its home state (Malta).

Clash of Law

Why is this a question in the first place? The foundational Treaty on the Functioning of the European Union (TFEU) explicitly recognizes the freedom to provide services (Article 56) as an imperative right to foster a harmonious internal market. The operators argued that their Maltese license and EU freedoms should override national restrictions.

However, the Court found that Member States making these restrictions is acceptable for public interest reasons. A valid license in Malta does not grant passporting rights to operate in Germany where those specific services are banned. In contrast to the unified passporting procedure available to Crypto-Asset Service Providers (CASPs) under MiCAR, there is no harmonized regulation for gambling in the EU. This makes an accurate, expert, case-by-case regulatory evaluation absolutely essential as will be substantiated in this post.

Crucial Lesson

The key takeaway to learn from this case is that geo-blocking and the strict non-solicitation of restricted jurisdictions are prerequisites in the current legal landscape.

Because of the strong consumer protections embedded in EU Private International Law (specifically Brussels Ibis and Rome I), if a court determines you targeted or marketed your services to consumers in an EU Member State, that state will likely claim jurisdiction and apply its own governing law. This risk is relevant not only to EU-based businesses, but to operators globally.

Importantly, any standard choice-of-law or choice-of-forum clause in your terms does not have a binding effect against a consumer (Brussels Ibis Art. 18 and 19; Rome I Art. 6(2))! They can bring a suit in their home jurisdiction (for example, in Germany). Relying on standard (and unenforceable) jurisdictional boilerplate could prove incredibly costly when faced with an unexpected lawsuit.

For those educated in or familiar with common law, remember the legacy of Owusu v Jackson (Case C-281/02): EU courts will not entertain forum non conveniens arguments to dismiss a case if jurisdiction is properly established.

Next Steps: Clean Hands and Abuse of Rights

As noted, the CJEU’s judgment on compatibility with EU law is only a stepping stone. What follows is the national court’s decision on whether the civil claim will actually succeed. A natural defense that comes to mind for legal professionals reviewing this, and potentially similar future cases (and an issue explicitly anticipated by the Advocate General in his Opinion on the case (see paras 96-97)), revolves around the maxim ex turpi causa non oritur actio, meaning no legal action should arise out of one’s own wrongdoing.

We are not contesting the specific individual in this case, but rather highlighting a universal legal principle known under various names: equitable estoppel, the clean hands doctrine, or the abuse of right. These refer to instances where a person uses a legal right in a way that puts their good faith into question.

Two primary schools of interpretation exist here:

• Subjective: Requires proving the person’s mental state and malicious intent.
• Objective: Presupposes that the right is being exercised contrary to its general socio-economic purpose.

This principle is widespread across both civil and common law systems, governing situations where a party attends court without entirely “clean hands”. Examples include Article 5 of the Polish Civil Code (KC); the French doctrine of abus de droit (famously, in Coquerel v Clément-Bayard); the German Civil Code (§§ 226, 242, 817 BGB); the Spanish Civil Code (Art. 7.2); and the Dutch Civil Code (Art. 3:13 BW).

Accordingly, consider a scenario where evidence demonstrates that a player actively sought out gambling services with clear intent, but subsequently pursues restitution exclusively in bad faith or with retributory motives, their conduct may constitute an abuse of rights. Such behavior could potentially cross the line which could be invoked as a defence against the restitution claim.

The Other Side of the Coin

To fully grasp the implications of “bad faith” operators must also consider the inverse of this doctrine. This was perfectly illustrated by the Swedish Supreme Court’s landmark July 2025 ruling in Case T 607-24 (Nätkasinot). In the Nätkasinot case, a player successfully sued to recover massive losses incurred after the casino classified him as a “VIP”. The Court found that the operator’s systems had actively tracked the player’s erratic behavioral data, such as high-frequency bets and escalating stakes, to target him with personalized marketing. Consequently, the Supreme Court ordered the operator to repay roughly 500,000 EUR.

This ties directly back to our earlier discussion on EU jurisdictional risks. Because of these consumer protection rules, a Swedish consumer will be entitled to sue in Swedish courts and invoke Swedish law.

It is important to note that while this ruling is binding only in Sweden (and is not a CJEU judgment), it reinforces a critical reality. Operators must keep an observant eye on jurisdiction-specific nuances, while also monitoring broader policy trends regarding enforcement. Only time will tell if the Swedish Supreme Court’s decision will spark similar rulings in other EU jurisdictions. After all, judgments from nations’ highest courts often carry a persuasive effect even across borders, although not strictly binding.

Key Takeaways

• Position your services properly! You must actively manage your jurisdictional footprint. Even with an EU-based license, if your services are targeting, or may be interpreted as targeting consumers in a restricted EU state– you are exposed.
• Respect the extra-territorial reach! By operation of EU Private International Law and its robust consumer protections, this exposure applies even if you operate from outside the EU. Standard choice-of-forum clauses are not a guarantee.
• Anticipate claims! The CJEU ruling means these types of consumer restitution claims are permitted under EU law, and we are highly likely to experience a wave of similar lawsuits in the future.