MGA revokes Winzon licence in enforcement move flagged as industry signal

The Malta Gaming Authority (MGA) has revoked the operating authorisation of Winzon Group Limited, in a move that signals a more assertive enforcement stance across the iGaming sector.

The decision, which took retroactive effect from 11th March 2026, was taken under regulation 10(2)(b) of Malta’s compliance framework and follows what the regulator described as “regulatory shortcomings”.

While licence revocations are not uncommon, the implications of this case may extend beyond a single operator. Kristof Szucs, Co-Founder of Kyborg.ai and an iGaming strategy and compliance consultant, framed the decision as a broader message to the market.

“The Malta Gaming Authority stopped bluffing. The question is whether your compliance infrastructure noticed,” MrSzucs said.

“Winzon Group lost its MGA licence. €147,080 in penalties. Standard compliance failure story – except what it signals to every other operator is anything but standard.

“When regulators move against a licence, they are not just closing one bad actor. They are sending a memo.”

Credit: Malta Gaming Authority

According to Mr Szucs, the regulator’s reference to “regulatory shortcomings” suggests failures that were visible enough to require action, rather than isolated or technical breaches.

“In regulator language, that usually means compliance failures were visible enough that silence would signal weakness on the regulator’s part,” he said.

Winzon Group reportedly operated around 40 iGaming sites, including Comix Casino, although several appear to have already ceased operations. At the time of writing, Comix Casino still references an MGA licence on its website.

The enforcement action triggers a series of obligations for the operator. Winzon is required to notify customers of the licence revocation via direct communication and on-site notices, which must remain visible for 30 days. It must also return all player balances to verified account holders and provide documented proof of completed withdrawals, including transaction records and corresponding bank documentation.

The company is further required to continue handling user data in line with its privacy policies and applicable data protection laws, while clearly informing players of how their information will be managed following the termination of its licence.

In addition, Winzon must remove all references to regulatory approval across its platforms. Financial liabilities also remain in place, including €46,693.23 in outstanding payments to the MGA and €147,080 in administrative penalties linked to multiple breaches.

Importantly, the revocation does not absolve the company of its responsibilities. The MGA has made clear that further legal action may be pursued should the operator fail to comply with its obligations.

The significance of the case lies in how it will be interpreted by the wider market.

“Every other MGA-licensed operator just learned what enforcement looks like. Not if you get caught. When the regulator stops bluffing,” he said.

“The bigger question is whether other jurisdictions are reading this the same way. Is this a precedent? Are compliance standards tightening everywhere?

“If you are operating under an MGA licence, you now have data on what happens when your foundation cracks. The question is not whether your platform works. It is whether your compliance infrastructure survives when it gets tested.”