Austria Builds a Stronger Payment-Blocking Regime — but Repeats Germany's Blind Spot
Government Bill 594 d.B., XXVIII. GP (amendments to the Glücksspielgesetz and the Telekommunikationsgesetz 2021); introduced in the Nationalrat on 5 August 2026. The new § 56e GSpG enters into force at the end of 31 December 2026. EFRI filed its parliamentary submission on 26 August 2026. Published on 26 August 2026. (Here you can download the submission.
Austria is about to give its fraud authority the power to switch off the payment rails of illegal online gambling. Under the new § 56e GSpG, participation in payment traffic for prohibited games published on an official blacklist becomes unlawful; the Amt für Betrugsbekämpfung can order any participant in the payment chain to stop within three banking days; breach of the ensuing decision carries fines up to EUR 1,000,000 or coercive penalties of EUR 30,000 per day, capped at EUR 750,000. It takes effect at the end of this year, before the licensing regime it accompanies.
The regulatory instinct is correct. But breach is designed to cost the intermediary nothing towards the person whose money moved: the explanatory materials (p. 23) state that protection of the individual player “is not intended”, that the prohibition is therefore not a protective statute under § 1311 ABGB, and that participants in the payment rail “shall suffer no civil-law disadvantages whatsoever”.
The architecture is not new. Germany has run it since 2021, and that record is the strongest argument against building it the same way twice.
Background: from collusion to gatekeeping
Austrian law already knew a form of bank liability for illegal gambling flows, but a vanishingly narrow one. Under § 52(1) Z 10 GSpG in its current form, a credit institution commits an administrative offence if it “knowingly” forwards a player’s asset transfer to the operator of prohibited games, and only where this occurs “in intentional direct collusion” with that operator. A provision requiring proof of both knowledge and collusion has, so far as can be seen, acquired no practical significance. The bill repeals it.
What replaces it is structurally different. § 56e attaches to publication rather than to collusion. The Amt für Betrugsbekämpfung maintains a blacklist under § 51a(2) GSpG, queryable in automated form, and the warnings published there “must contain features enabling the respective payment service provider to identify, in an automated manner, those transactions covered by the prohibition of § 56e(1) and (2) (with regard to banks, in particular: IBAN)”. Once an offer is listed, the prohibition binds everyone in the payment chain. Where the authority encounters an operator not yet listed, it may address a participant directly, ordering cessation within three banking days and granting a comment period of up to two weeks; the information is then published so that all other participants must observe it within three banking days. If the conduct continues, an administrative decision follows under § 56e(4), with a compliance deadline of up to two weeks and no suspensive effect on appeal (§ 56e(8)).
The scope of addressees is deliberately functional. The materials state that “participants in payment traffic” is not limited to payment service providers within the meaning of the ZaDiG 2018 and expressly includes operators of payment systems “and similar undertakings”. Payment traffic itself is to be understood broadly, covering all transactions connected with prohibited games, in particular deposits and withdrawals.
The transformation is therefore real, and it should be described accurately: § 56e converts an extremely narrow, collusion-dependent responsibility of credit institutions into a general, list-based and administratively concretised duty to act, binding on every participant in the payment chain irrespective of knowledge or complicity.
The asymmetry in the text
§ 56e(9) bars damages claims where an intermediary, “in negligent ignorance that the suspicion of a prohibited game was false”, executed a transaction late or not at all. One that blocks a lawful payment by mistake is statutorily shielded. EFRI does not dispute the rationale: no blocking regime works if every precautionary block invites litigation.
But the explanatory materials do not mention § 56e(9) at all. They comment on paragraphs 1 to 8 and stop, in the ministerial draft and the government bill alike: the one provision expressly regulating civil liability, in favour of the regulated industry, passes in silence. The countervailing exclusion, meanwhile, is nowhere in the statute — the proposition that an intermediary faces no civil consequence for failing to block a payment it was required to block, after listing, after notification, after the deadline, lives only in the materials. Block wrongly, and the statute protects you; fail to block at all, and the materials say you are equally safe. The consumer bears the loss either way.
That exclusion is boilerplate, appearing verbatim three times: page 21 for orders against hosting, caching and search services (§ 56c), page 22 for network blocking by access providers (§ 56d), page 23 for payment blocking (§ 56e). A module reproduced across three structurally different instruments is not an assessment of what a payment freeze is for — and the materials contradict themselves: a few lines before the same formula, the commentary on § 56d records that through those measures “players are protected against unauthorised offerings”, and the general part makes satisfaction of all judgments obtained by injured players — “Spielerschutzklagen” — a precondition for a concession. Civil claims by players are, on the bill’s own architecture, a recognised instrument of player protection, excluded categorically only against payment intermediaries.
Where the drafters did intend to exclude civil effects, they said so in the statute: § 31d(1) GSpG declares the responsible-advertising standard supervisable “exclusively by way of supervision”, closed to action under the UWG, and expressly “not a protective statute within the meaning of § 1311 ABGB”. For breach of the § 56e cessation duty there is no such command. Materials aid interpretation; they do not bind courts. That different treatment within one amending act tells against a comprehensive civil-law exclusion — and leaves years of litigable uncertainty, borne by injured consumers and by intermediaries who cannot price a risk nobody can define
The German experiment: five years of a supervision-only model
A central regulator, a blacklist, orders against payment intermediaries, orders against internet infrastructure, no private right of action — that is the Glücksspielstaatsvertrag 2021, operated by the Gemeinsame Glücksspielbehörde der Länder (GGL) since 2023.
Network blocking collapsed in court. On 19 March 2025, the Bundesverwaltungsgericht confirmed that § 9(1) sentence 3 no. 5 GlüStV 2021 cannot be applied to access providers “in any conceivable case of application”. None have issued since 2022; the GGL redirected to host providers, reporting roughly 930 blocked domains and about 60 more monthly. For scale: some 820 illegal gambling sites were reachable from Austria in 2025 alone. Offer-side blocking is a treadmill.
Payment blocking works, slowly and case by case. The Verwaltungsgericht Halle upheld on 2 October 2024 a blocking order against a Swiss payment service provider, extending it to unlicensed gambling generally. For 2024 the GGL reports 165 illegal sites on which payment through the common providers was no longer possible — with the qualification that matters: operators respond by accepting the loss of mainstream payment methods and are moving to less well-known providers (eager to accept shady merchants).
The black market is disputed and, independently estimated, large. The GGL puts the unregulated share of the German online market at 23 per cent for 2024. The Handelsblatt Research Institute, in an October 2025 study combining web-traffic analysis, tax data and a survey of 1,021 online gamblers, puts it above 50 per cent for the online segment and at 70–80 per cent for online casino and virtual slots; the Hessisches Finanzgericht referred in 2024 to above 80 per cent for virtual slots. The gap has causes beyond enforcement design, and the studies differ in method and interest. But no reading of the evidence supports the claim that supervision alone has contained the German illegal market.
“And the private channel has so far largely failed at the regulatory-notification threshold. The Oberlandesgericht Köln held on 23 June 2022 (18 U 8/21) that payment service providers, given their limited business purpose and the mass nature of transactions, need not concern themselves with the interests of the parties to the payment. On 24 April 2026 (19 U 134/25) it dismissed a claim against a Cypriot payment-receiving entity owned by a Curaçao operator, holding (paras 82–83) that liability presupposes that “the payment service provider must as a rule have been officially notified of the unlawfulness of the gambling offering and have been prohibited from participating in payments”. No notification had occurred.
That is not a holding that intermediaries can never answer for the money they moved. It is a holding about what was missing — and what was missing is exactly what § 56e supplies: official identification, published identifiers, notification, a deadline. Austria is about to build, in statute, the very trigger German courts treat as the threshold of responsibility, and then disconnect the wire behind it in the materials. A member state need not run the same experiment twice to learn its result.
The case for the drafters — and the Austrian counter-authority
The government’s position deserves its strongest statement. Payment blocking is a market-order instrument: it creates an illegal market rather than compensating individuals, and fines flow to the state. Intermediaries run mass automated systems and must execute authorised orders; liability risk may drive defensive over-blocking. And the player is not remediless — Austrian courts award restitution against unlicensed operators, and the bill conditions any concession on paying such judgments. That answer fails wherever the operator remains outside the Austrian licensing regime: a concession condition has no leverage over an operator that does not seek a concession in the first place.
Austrian law also supplies the drafters’ strongest card. The Oberster Gerichtshof has held that the anti-money-laundering provisions of the Banking Act, in particular § 41 BWG, serve public interests and are not protective statutes for third parties injured by predicate offences (RIS-Justiz RS0126061; foundational OGH 19 May 2010, 8 Ob 145/09w). The parallel to § 56e will be drawn — and it does not hold. Those AML duties attach to the institution’s own suspicion and risk assessment: addressee-open, permanently operating obligations identifying no particular payment flow, following no official order, running to no deadline, so that both the protected class and the causal chain would have to be constructed out of a general standard of conduct. § 56e is the structural opposite: the authority performs the gambling-law assessment, designates the payment flow by identifying features, and sets a fixed period to act. The protected class needs no construction; it is the players whose payments to the listed offering the order exists to stop.
Two questions the bill leaves open
The list under § 51a(2) must be payment-channel-neutral. Illegal operators do not receive money into accounts bearing their own name: funds arrive through acquirers and payment facilitators, e-money institutions, pooled and trust accounts, virtual IBANs — including virtual IBANs issued in the paying customer’s own name — and merchant-of-record structures in which some entity other than the operator appears in the payment record. A list of operator IBANs would be circumvented within weeks; the German regulator’s observation that operators migrate to less visible providers is the same finding from the other side. Alongside IBANs the list needs merchant identifiers, acquirer references, payment references of interposed providers and wallet addresses, and crypto-asset service providers under Regulation (EU) 2023/1114 should be named as addressees in terms.
Second, the bill addresses “all participants in payment traffic” but does not explain how the order under § 56e(3), the cessation decision under § 56e(4) and the coercive penalties under § 56e(7) are to be served and enforced in time against a payment institution in Lithuania, Malta, Ireland, the Netherlands or any other foreign nation. Here the exclusion of private enforcement costs most: civil judgments circulate across the Union under Regulation (EU) 1215/2012 without exequatur (Articles 36, 39), and Article 7(2) opens a forum at the place where the harmful event occurred; on applicable law the Court of Justice held in Case C-77/24 (Wunner, 15 January 2026) that for claims arising from losses at illegal online gambling the damage under Article 4(1) Rome II arises, in principle, in the member state where the player is habitually resident. Against a foreign intermediary, civil responsibility is not a duplication of supervisory law. It is realistically the more effective of the two.
Our Assessment
The direction of travel is right, and EFRI says so without qualification: the payment rail is the one bottleneck an offshore operator cannot replicate at will. It can generate a hundred domains in an afternoon, increasingly with generative tools that make clones, brands and localised campaigns nearly costless, but not a hundred connections to the regulated financial system. That the German regulator blocks roughly sixty domains a month while some 820 illegal sites remain reachable from Austria shows why the money, not the domain, is the place to intervene.
“And yet the role of the payment intermediary in the infrastructure of illegal online business remains under-recognised. In EFRI’s casework, regulated financial intermediaries repeatedly form the bridge between European consumers and offshore operators.
The bill recognises the intermediary as a gatekeeper for public enforcement, but the explanatory materials revert to the ‘neutral pipe’ logic once the question becomes who bears the loss after that gatekeeper culpably fails to act.
That blind spot is not confined to gambling; it is the one we meet across investment fraud. The operator is the visible defendant, the payment institution is filed under infrastructure, and the fact that no victim’s money reaches an offshore platform without a regulated European entity processing it drops out of the legal analysis. To designate the intermediary a gatekeeper — as § 56e does — while declaring its breaches irrelevant to the people whose money it processes is that blind spot written into statute.
Germany provides the closest mature European comparator, and its experience is instructive. Austria is entitled to build the same machine. It is not obliged to build in the same disconnection.
EFRI’s submission asks only this: where the authority has listed an offering with its identifying features or directly notified an intermediary, the deadline has expired, and the intermediary thereafter culpably continues to enable exactly those transactions the law forbids, that breach should be capable of legal significance towards the person it was meant to protect. No general liability of banks for gambling losses, no duty to investigate customer relationships without concrete indications, no encroachment on the § 56e(9) shield. Wrongfulness, fault, causation, protective scope and the injured party’s own contribution (§ 1304 ABGB) all remain to be established case by case; the clarification places the concretised blocking duty within the protective scope of ordinary tort law, and does nothing more.
If the legislature will not put that in the statute, the minimum is to delete the passage from the materials and leave the question of protective purpose with the courts. The window is short: § 56e takes effect at the end of 31 December 2026, and what is not corrected in committee will be law from the turn of the year. Austria is building a modern instrument against illegal digital business models. It should not, in the same act, establish the opposite principle: that breaching a gatekeeping duty is of no concern to the people the duty exists to protect
