MGA Reviews Suspicious Transaction Reporting in Sports Betting

The Malta Gaming Authority (MGA) has published a thematic review on how licensed companies detect, assess and escalate integrity risks in sports betting. The review examined, on a risk-based sample, operators that submitted few or no Suspicious Betting Reports. The study covered both B2B and B2C models and was based on audit meetings, documents and additional explanations collected between the second and fourth quarters of 2025.

One point the Authority highlighted was that a low number of reports alone does not mean inadequate monitoring. Some operators apply restrictive betting limits, cautious betting markets, and remove events that appear open to manipulation at an early stage, including some youth matches. These preventive measures reduce integrity risk and lower the likelihood that suspicious activity arises.

The review showed significant differences between companies using real-time sports betting monitoring systems and those relying mainly on alerts from B2B or data partners. Common warning signs included clusters of bets concentrated on the same market, repeated behaviour across accounts sharing common credentials, and sudden or unusual changes in bet amounts. The MGA stressed that system-generated alerts should be assessed together with informed human review and access to underlying betting data.

The review found that some companies depend heavily on external integrity monitoring organisations and only start internal investigations when those providers raise an alert. The Authority also clarified a misunderstanding affecting multi-jurisdictional operators. It stated that activities involving players under an MGA licence must be reported even if similar patterns are seen in another regulatory area.

All companies reviewed had an internal escalation process, but its formality and clarity varied considerably. Cases typically reached operations or risk teams first, after which compliance staff decided whether a report should be submitted. In many policies, the role of the Key Function Holder for compliance, the workflow from detection to reporting, and the applicable reporting timeframe were not clearly documented. The MGA called on operators to document responsibilities, review policies regularly and develop targeted training.