Malta licenses the company, but reviews rate the brand

On 28th September, the Malta Gaming Authority (MGA) published a four-paragraph notice. Condor Malta Limited, holder of licence MGA/B2C/340/2016, had its authorisation suspended with effect from 16th September under the Gaming Compliance and Enforcement Regulations. The notice gives a company name, a company number and a licence number. It does not name a single website.

Anyone who wanted to know what that meant in practice had to do the matching themselves. iGamingCapital.mt's report on the suspension listed the consumer-facing brands, 24Bettle, b-Bets, Big5Casino, Casino Sieger and LuckyBull. Those names are what a customer would actually recognise. The licence number is what the regulator acts on.

I am not criticising the MGA for that. Its notices are written for the legal record, and the legal record is the licensee. My point is about the rest of us, the people who write about operators for a living. We have built a whole layer of this industry around the wrong unit.

The regulator sees one company. The player sees a logo

I have spent six years reading operator terms, and the review format I learned treats every brand as a standalone business. Each one gets its own score and its own verdict on safety. That is a convenient fiction. In Malta, accountability sits with the authorised person: the company that holds the licence, answers to the MGA, safeguards player funds and runs the player protection controls. A brand is a front end on top of that company.

Most of the time the fiction does no harm. It starts to matter when something goes wrong at licence level, because a suspension or a weak control does not stay on one website. It applies to every domain the licensee operates. The MGA's annual report counted 311 licences at the end of 2025, and a single licence can carry dozens of websites.

The MGA's own review found the gap

The clearest evidence came from the regulator. In February, the MGA published a thematic review of self-exclusion practices, which this site covered at the time. Between the first and second quarters of 2025, it mystery-shopped 20 B2C licensees across 58 active URLs, opening accounts on three brands per licensee. Three licensees let a player register, deposit and play on a sister brand using details similar to those of an account that had already been self-excluded. Two failed to close an account within 24 hours of an emailed request, four did not offer limit-setting at registration or first deposit, and six ran reality checks that were missing mandatory information.

The cross-brand finding is the one that should bother anyone in the review business. It is a test that only makes sense if you know which brands belong together. The MGA knew, because it picked three brands under the same licence. Most players would not know, and most review pages would not have told them.

The rule is drawn along the same line. Under the Player Protection Directive, where a licensee runs several brands with separate registration, and there is no unified self-exclusion database for remote gaming, a self-exclusion may be limited to the brand on which it was requested. It must cover every brand only where there are sufficient reasons to indicate a gambling problem. So whether an exclusion carries over can depend on two facts the customer rarely sees: who owns the site, and which other sites share its licence.

The licence is public. We just don't print it

None of this is secret. Every MGA licensee is on the public register, and every compliant site prints its licence number in the footer. The trouble is that the number lives in the smallest type on the page, and the review industry, my own corner of it included, has mostly left it there. It changes how a ranking reads once the number gets its own column.

Casino.net's Malta casino reviews print the MGA licence number next to each operator in the licensing table, and there Casiku, Playzee and SpinYoo, three separate entries in the Malta top ten, all carry the same licence, MGA/B2C/370/2017.

Put that number into the MGA's licence verification record and the holder is White Hat Gaming Limited of Valletta, with 51 website domains listed against that one B2C licence. There is nothing irregular about this. Multi-brand operation is how a large part of Malta's B2C sector is built, and the thematic review did not name the licensees that fell short. But a customer comparing Playzee with SpinYoo is not comparing two companies' complaint handling or compliance records. They are comparing two front ends on one licence, and a review that scores them as rivals on safety is measuring the website rather than the protection behind it.

What I would like to see change

For reviewers and affiliates, the fix is cheap. Print the licence holder and number beside every brand, not in a footnote. Group brands that share a licence, and say so on the page. When the MGA acts against a licensee, update every brand on that licence the same day instead of waiting for someone to spot the logo in a news story.

For the MGA, the ask is small too. The register already holds the domain list for each licence, so making it searchable by website, where you type a domain and see the licensee and its sister sites, would turn a compliance record into something a customer can use. Enforcement notices could list the licensee's registered domains. And the authority's own recommendation in the self-exclusion thematic review, a centralised exclusion database wherever several brands run under one licence, would close the gap the directive leaves open.

Condor's notice had a licence number and no websites. Most review pages have the opposite problem.