The Netherlands Gambling Authority (Kansspelautoriteit or Ksa) continues its rigorous enforcement of player protection standards as 2025 comes to a close. On December 19, 2025, the regulator publicly announced a formal warning issued to the licensed operator SCGO Limited, the parent company of the betting brand Vbet.

The warning centers on a critical technical failure regarding playing time limits—a mandatory feature of the Dutch Remote Gambling Act (Koa). The Ksa found that Vbet’s system was failing to aggregate playing time across multiple sessions, effectively allowing players to gamble indefinitely despite setting strict limits.

This incident serves as a crucial case study for operators and affiliates targeting the Netherlands in 2026: technical glitches in Responsible Gambling (RG) tools are no longer treated as bugs, but as violations of the law.

The Violation: The “Session Reset” Glitch

To understand the warning, we must look at the specific mechanics of the Dutch regulation. Under the Koa Act, every player must set a maximum duration for their gambling activity (e.g., 2 hours per day) upon registration.

What Vbet did wrong: The Ksa investigation revealed that Vbet’s software was interpreting this limit as a “per session” cap rather than a cumulative daily cap.

  • The Loophole: If a player set a 2-hour limit, played for 1 hour and 55 minutes, logged out, and then logged back in immediately, Vbet’s system would reset the timer to zero.
  • The Consequence: A vulnerable player could bypass their own self-imposed safety net simply by re-logging, rendering the protection tool useless.

The Ksa explicitly stated that limits must be aggregated. If a player sets a daily limit, the system must sum up every minute spent on the platform within that 24-hour window, regardless of how many times they log in or out.

Why a Warning and Not a Fine?

The Ksa has the power to issue massive administrative fines (often exceeding €1 million) or even revoke licenses. In this case, they opted for a formal warning.

This decision likely reflects:

  1. Corrective Action: Vbet reportedly acknowledged the error and has already deployed a technical fix to ensure sessions are aggregated correctly.
  2. Non-Malicious Intent: The regulator likely viewed this as a software logic error rather than a deliberate attempt to exploit players (though the impact on player safety remains severe).

However, the Ksa noted: “Providers must ensure that their systems work as intended. Limits are a core pillar of the duty of care. Technical errors that undermine these limits are unacceptable.”

The 2026 Compliance Landscape: Zero Tolerance

This warning is part of a broader trend of “Zero Tolerance” emerging in late 2025. Following political pressure from the Dutch House of Representatives to tighten gambling rules, the Ksa is inspecting the technical functionality of casinos more than ever.

What Operators Must Do:

  • End-to-End Testing: Operators can no longer rely on platform providers’ assurances. They must manually test “edge cases”—like logging out and back in—to ensure limits trigger correctly.
  • Cross-Device Aggregation: Limits must track time across mobile and desktop. If a player plays 1 hour on iPhone and 1 hour on PC, the system must count 2 hours.
  • Real-Time Monitoring: The Ksa expects real-time intervention. A 5-minute delay in processing a limit could be grounds for a fine in 2026.

Impact on the Market

For Vbet, this is a reputational hit but a survivable one. They remain licensed.

For the wider market, it is a wake-up call. The “Session Time” vs. “Daily Time” confusion is a common pitfalls in iGaming software development. By making an example of Vbet, the Ksa is signaling that it understands the code behind the casinos—and it is watching.

Key Takeaway: In the Netherlands, “Duty of Care” is not just a policy document; it is a line of code that must function perfectly every single time.