The Dutch market has made one point very clear since regulation: a licence confirms access to the market, not control over compliance.

When the Kansspelautoriteit (KSA) fined TOTO Online and BetCity operator Betent €400,000 each, the issue was not aggressive advertising or misleading claims. It was something more fundamental. Both operators sent promotional messages to customers under the age of 24, despite already holding that data.

For experienced teams, this is not a theoretical risk. It is a practical failure inside everyday marketing workflows.

Two €400,000 fines, one preventable mistake

The KSA’s decision against TOTO Online focused on a campaign period between October 2021 and February 2022. During this time, marketing emails promoting gambling products and bonuses were sent broadly across the customer database.

The problem was not the message itself. It was the audience selection. Customers under 24 were included because age-based exclusions were not properly applied.

TOTO stopped the activity and accepted the regulator’s decision. No appeal was filed, and the case is now closed.

BetCity, operated by Betent at the time, faced a similar outcome in April 2023. The KSA found that sufficient safeguards were not in place to prevent young adults from receiving gambling promotions during the early phase of the regulated market.

The result was identical: a €400,000 penalty and a final enforcement decision.

These cases were not isolated. Other operators, including JOI Gaming, Hillside (bet365) and Bingoal, also received fines at the same level. The pattern matters more than the individual brands.

Why “registered users” are still a restricted audience

A common assumption in CRM-driven marketing is that registered users are a compliant audience. They have passed age verification, created an account and often opted in to receive communication.

Dutch regulation adds a stricter layer. Operators are not allowed to target young adults with gambling advertising, regardless of consent.

This creates a clear obligation. If an operator knows a customer is under 24, that customer must be excluded from promotional campaigns.

Sending one campaign to the entire database does not remove that responsibility. It confirms the failure.

Bonuses increase the risk further. They are designed to encourage deposits and repeat play, which is exactly why regulators treat them as sensitive.

In practice, consent and compliance operate separately. One does not replace the other.

The real issue: breakdowns inside marketing operations

These enforcement cases were not driven by creative choices or brand messaging. They were operational failures.

The wrong audience received the right campaign.

This shifts compliance into areas that are sometimes treated as purely technical or commercial. Audience segmentation, CRM logic and campaign execution are part of regulatory responsibility.

Before any campaign is sent, operators should be able to answer three simple questions:

• Who exactly is included in this audience?
• Which groups are excluded, and why?
• Can we prove those exclusions worked?

Weaknesses often appear in familiar places. Outdated audience segments, manual data exports, reused campaign templates or external tools that are not aligned with internal controls.

Agency involvement can introduce another layer of risk if approval processes are unclear. Responsibility does not disappear when execution is outsourced.

What effective campaign control looks like in practice

Compliance in marketing is not achieved through policy documents alone. It requires systems that make the correct action the default.

At a minimum, operators should implement:

• Automatic age suppression rules that cannot be easily bypassed
• Clear separation between transactional and promotional messaging
• Documented approval workflows before campaign release
• Audit trails showing audience selection, exclusions and timing
• Consistent synchronisation between player data, CRM tools and email platforms

Testing is just as important as configuration. Creating test accounts across different age groups quickly shows whether controls work under real conditions.

A written rule has limited value if a campaign can ignore it with one incorrect setting.

Advertising rules in the Netherlands have tightened further

Both cases took place shortly after the Dutch online gambling market opened in October 2021. Since then, the regulatory framework has become stricter.

From July 2023, untargeted advertising for online gambling has largely been banned. This significantly reduced visibility across television, radio, print and public spaces.

Sponsorship restrictions followed. As of July 2025, operators can no longer promote their brands through Dutch sports teams, athletes or competitions.

Targeted online communication is still allowed, but only when strict controls are in place. Operators must actively prevent exposure to minors, young adults and other vulnerable groups.

This increases the importance of reliable data, controlled segmentation and documented decision-making.

Responsibility does not stop at the operator level

The KSA has been consistent on one point: licensed operators remain accountable, even when third parties are involved.

This includes affiliates, media partners and external marketing agencies.

For affiliates and content teams, this creates a similar expectation. Content should not encourage irresponsible behaviour, misrepresent bonuses or ignore risk disclosures.

An independent editorial approach helps reduce that risk. It separates commercial goals from compliance decisions and ensures that content remains accurate and transparent.

In regulated markets, independence is not a branding choice. It is part of maintaining trust and credibility.

Why this matters beyond fines

A €400,000 penalty is significant, but it is not the only consequence.

Regulatory scrutiny increases after each breach. Internal resources shift from growth to remediation. Brand reputation becomes harder to manage, especially in a market where public and political attention remains high.

More importantly, these rules exist to reduce harm. Young adults are considered a higher-risk group, which is why they receive additional protection under Dutch law.

Compliance is not only about avoiding enforcement. It reflects how seriously an operator treats duty of care.

The broader lesson for Dutch iGaming teams

Both cases started with a simple action: sending a campaign.

No complex strategy, no controversial messaging. Just a routine marketing task that failed at execution level.

That is what makes these examples useful. They show where real risks exist.

Strong compliance does not mean stopping communication. It means building processes where compliant communication happens by default.

Content, data, tooling and approvals must work together. If one part fails, the entire system is exposed.

Conclusion: compliance is operational, not theoretical

The TOTO and BetCity fines highlight a practical reality of the Dutch market. Most compliance failures do not start with intent. They start with small gaps in systems, workflows or oversight.

For operators, affiliates and editorial teams, the priority should be clear. Make compliance visible inside daily processes, not just in policy documents.

If you are reviewing your current setup or planning to improve how your content and campaigns align with Dutch regulation, explore the latest insights on Maurice Kruytzer’s knowledge platform or reach out directly for editorial support that combines compliance, localisation and publication-ready quality.