Most coverage of Finland's licensing regime stops at the fee, the tax and the timetable. The requirement that will consume the most engineering time is barely mentioned: licensed operators must report gambling data to the regulator in a prescribed form, using a cryptographic signing system set out in the National Police Board's binding regulations.
Reporting is not an afterthought here
The Act requires regular reporting to the supervisory authority, and separately requires that an operator complete an integration project connecting its systems to the regulator's supervision system before it can begin operating. Those two requirements are the same piece of work seen from different angles, and neither can be satisfied late.
The cryptographic signing element matters because it changes what the work is. Signing transaction data means key management, secure storage, defined formats and an audit trail that has to hold up under inspection. That is platform work, not configuration, and in most operator architectures it sits with the platform provider rather than the operator.
Where this lands commercially
An operator contracting a platform in 2026 is buying a Finnish reporting capability that does not yet exist in that platform. Whether it is built in time is a supplier question, and the supplier in question may not hold a Finnish software licence until 2027 at the earliest.
The sequence is worth stating plainly. Operators sign platform deals now. Platforms build Finnish reporting during 2026 and 2027. Operators complete integration with the regulator after their licence is granted and before July 2027. Suppliers then license themselves during the following twelve months, before the July 2028 obligation.
Every one of those steps depends on the one before it, and the regulator is running the integration phase with dozens of operators at once.
What to ask a platform provider
Three questions separate a supplier that has done this work from one that intends to. Has the reporting specification been implemented against the National Police Board's published regulations, or is it on a roadmap. Who holds the signing keys, the operator or the platform, and what happens at contract termination. And what is the tested integration timeline, measured from licence grant to regulator sign-off, rather than an estimate.
Status of this analysis
The reporting and signing requirements are established in the Act and in the Police Board's binding regulations. The description above of what implementing them involves is our own assessment, informed by how comparable reporting regimes have worked in other regulated markets. Operators should confirm the technical specification directly with the authority and with Finnish counsel rather than relying on this summary.
