Finland's reform is framed by the government as a public health measure as much as a market opening. The player protection requirements are correspondingly central to the licence, not an appendix to it.
A note on sourcing. The Ministry of the Interior confirms the existence of safeguards against misuse, anti-money laundering obligations and the supervisory powers that enforce them. The specific mechanisms below come from published legal commentary on the Act and from implementing rules that are still developing, so each section is marked accordingly.
Official: enforcement has teeth
The Finnish Supervisory Agency, which takes over from 1 July 2027, is funded by licensee fees. It can impose administrative fines and penalty payments, suspend and withdraw licences, and order illegal gambling provision or marketing to stop under threat of a conditional fine. Decisions on these measures are public, which means a compliance failure leaves a public record. The sanctions guide sets out the reported fine bands.
Reported: identification before play
All gambling under a Finnish licence is described as requiring player registration and identification, with a minimum age of 18, verified before play rather than at a spending threshold. If that holds, frictionless or anonymous onboarding is not available in Finland. How identification works in practice, through the Finnish Trust Network and bank ID, is covered in our identification guide.
Reported: a single national self-exclusion register
Finland is described as establishing a centralised self-exclusion system applying across every licensed operator: a player who excludes with one operator is excluded from all, and operators must integrate with the register and honour exclusions.
This is the requirement we would flag hardest to a technical team. A shared national register is a real integration project, and in comparable markets it has taken longer than operators expected. It also sits alongside the separate mandatory integration with the regulator's supervision system described in our reporting analysis.
Reported: deposit limits set before play
Players are described as having to set a deposit limit before they can gamble. The limit is player-defined but its existence is mandatory. The Act is also reported to allow loss limits to be introduced later by government decree, so operators should build for the possibility that maximum loss limits follow. The evidence base for any such decree is likely to come from THL, the national research institute with a statutory role in monitoring gambling harm.
Reported: monitoring with a duty to intervene
Licence holders are described as having to monitor player activity on an ongoing basis to identify excessive or harmful play, and to intervene rather than merely record. Where implementing rules define what intervention means in practice, they have not been published. Intervention pathways lead to services such as Peluuri and the A-Clinic Foundation, and operators should establish how referral is expected to work.
Reported: no cryptocurrency
Cryptocurrency payments are described as not permitted. Payment methods should be expected to be limited to those that support identification and monitoring.
Reported: verification before launch
Gambling systems must be independently verified before launch, and licence holders report regularly to the supervisory authority.
Why this matters commercially
The requirements are similar in kind to Sweden and Denmark, but the national self-exclusion register and mandatory pre-play deposit limits place Finland at the stricter end. An operator whose model depends on frictionless onboarding or high-value VIP programmes will find both constrained. Operators already running in the Nordics will recognise most of the framework and should still budget for the Finnish-specific integrations.
Status of this guide
Implementing decrees on loss limits and technical standards are still developing, and none of the operational provisions are in force yet. Treat this as the shape of the framework, note which statements are official and which are reported, and confirm specifics with counsel and, from July 2027, with the Supervisory Agency's published requirements.
