Cyprus, illegal gambling and AI: what the regulator actually said

The National Betting Authority of Cyprus has put automated detection at the centre of its safer gambling agenda, saying technology, enforcement and public health measures have to work together if gambling-related harm is going to fall. That is the announcement. What it is not, on the evidence available, is the launch of a named AI system that hunts unlicensed casino domains.

The remarks came from President Panagiotis Trisokkas at the authority’s ninth annual conference, staged alongside Cyprus’s Safer Gambling Week under the slogan “Play within limits. Play safely.” Trisokkas argued that compliance on its own is not enough and that consumer protection has to be built into how the industry operates, not bolted on at the end. Delegates worked through illegal betting, artificial intelligence, public health questions and the direction of European gambling regulation. On AI specifically, regulators at the event pointed to the potential of machine learning and data analytics to spot harmful gambling behaviour earlier and to trigger intervention sooner.

Illegal gambling sat in the same room as that discussion. The authority described unlicensed activity as a continuing threat to a sustainable regulated market. Two separate tracks, one conference.

The condition most coverage skips

There are two defensible readings of what Cyprus is doing, and they lead to different expectations. The first is that AI is being turned on unlicensed operators: scanning the open web, matching domains against the licensing database, feeding a blocklist. The second is that AI is being turned on player data held by licensed operators, to identify people whose play pattern suggests harm.

The reported detail supports the second reading. The potential cited was for detecting harmful gambling behaviour earlier and supporting intervention, which is a player-protection function sitting inside licensed operators’ own data. The crackdown on illegal operators was framed as policy and enforcement priority, not as an algorithm.

The first reading is not stupid, and it may well be where Cyprus ends up. Automated monitoring of unlicensed sites is becoming ordinary regulatory plumbing, and an authority that has just spent a conference on both illegal betting and AI is unlikely to keep the two apart forever. But until the authority publishes something concrete, treat “Cyprus deploys AI to catch illegal operators” as a direction of travel rather than a live system. The distinction matters because the two uses carry very different legal baggage: harm-detection analytics run into data protection questions, while domain detection runs into cross-border enforcement limits.

How automated detection of unlicensed sites generally works

Where regulators do run automated detection against unlicensed betting sites, the method is more mundane than the word “AI” suggests. It is pattern matching at scale, and most of it is public-data work.

The signals that get flagged

  • Domains and mirror domains offering real-money games to residents, cross-checked against the licensing database of permitted operators.
  • Advertising and affiliate traffic pointing local users toward brands that hold no local licence.
  • Payment routes, including the accounts, processors and crypto addresses a site accepts deposits through.
  • Reused site templates, game lobbies, terms and conditions and contact details that link a new domain to an already-flagged brand.
  • Geo-targeting signals: local language, local currency, local payment methods on a site with no local authorisation.

What happens once an operator is flagged

Detection is only the first step, and it is the cheapest one. The enforcement chain that follows typically includes publication on a public blacklist of unlicensed operators, instructions to internet service providers to block the domain or IP range, notices to banks and payment providers to refuse transactions to and from the site, takedown requests to advertising platforms and app stores, administrative fines where the operator or its officers fall within reach, and referral to prosecutors or to the regulator in the operator’s home jurisdiction. Cyprus’s own measures should be read against the authority’s published decisions rather than assumed from this general pattern.

Why the push is landing now

The stated motivation is market sustainability plus consumer protection. If unlicensed sites keep taking local bets, licensed operators pay the cost of compliance while competing against businesses that pay none of it, and players who lose money on an unlicensed site have no regulator to complain to. The authority’s position is that enforcement against those operators and harm-reduction work inside the regulated market are the same project, which is why the illegal-gambling discussion sat next to the AI and public health sessions rather than in a separate track.

Safer Gambling Week framing matters here too. The week’s focus was awareness, education and protecting young and vulnerable consumers. Harm-detection analytics fit that agenda neatly, and they are easier to pilot than a blocking regime, because they rely on data the regulator can require licensees to collect.

Part of a wider move toward tech-driven enforcement

Cyprus is not inventing anything here. Across European markets, blacklisting unlicensed domains, instructing ISPs to block them and leaning on payment providers to cut off transactions have become standard regulatory tools, and automated monitoring is what makes those lists maintainable at all. Checking a few thousand domains by hand is not a job anyone can staff. Regulators have also pushed in the other direction, requiring licensed operators to run their own automated markers-of-harm monitoring. Readers who want the specifics of any individual country’s programme should go to that regulator’s published statements rather than to industry summaries, including this one.

What changes for operators, affiliates and players

Licensed operators get the clearest benefit: every blocked domain is a competitor that no longer undercuts them with faster signup, no verification and bigger bonuses. The gain is real but partial, since blocked sites tend to reappear.

Affiliates carry the sharpest new risk. Promoting a brand that is not licensed locally is the kind of activity automated monitoring is good at finding, because affiliate links, landing pages and ad creatives are public by design. An affiliate who checks licence status once a year is checking too rarely.

For players, the practical takeaway is narrow and useful: verify the licence at the regulator, not at the casino. A licence number in a site footer is a string of characters that anyone can type. The National Betting Authority of Cyprus maintains the register of operators it has authorised, and a site that does not appear on it is not licensed in Cyprus whatever its homepage claims. Licensed sites are also where the protective tools actually live, including deposit and loss limits, time-outs and self-exclusion. An unlicensed site has no obligation to honour any of them, and no regulator to answer to when it does not.

Where AI enforcement breaks down

Automated detection finds sites. It does not shut them down, and that gap is where most of the leakage happens. A determined operator registers a new domain within hours of the old one being blocked, and clone sites are cheap because the entire stack is templated. Players route around ISP blocks with a VPN, which also defeats geo-blocking at the operator’s end. Hosting and corporate structure sit offshore, so administrative fines are often unenforceable in practice and referral to a foreign regulator depends on that regulator caring.

Then there are false positives. A classifier that flags sites by pattern will sometimes flag a licensed operator’s legitimate mirror, an affiliate review page or a dormant domain, and a wrongly blocked business needs a route to appeal that resolves in days rather than months. On the harm-detection side, the error cost runs the other way: flagging a recreational player as at-risk is intrusive, and failing to flag someone who is in trouble is the failure the whole exercise exists to prevent.

What to watch from here

The open question in Cyprus is not whether more technology arrives, but which of the two uses gets a legal basis first and on what terms. Harm-detection analytics need rules on what operators may infer from player data and what they must do once they have inferred it. Domain and payment blocking needs cooperation from parties the authority does not license, including ISPs, banks and ad platforms. Neither is settled by a conference speech, and the authority’s next published decisions will say more than the announcement did.

If you gamble, keep it to money you can afford to lose, use the limit and self-exclusion tools at licensed sites, and seek support from a recognised problem gambling service if play stops feeling like a choice.