Sweden’s regulation SIFS 2026:3 made every Spelpaus check traceable to the licensee from August 1, 2026. A month later, a PowNed test showed Cruks being beaten at Dutch casino doors with a borrowed ID.

A self-exclusion register can be beaten in two places. One is the code that queries it. The other is the door, where a staff member decides whether the face in front of them matches the card in their hand.

Sweden spent the past year hardening the first. Weeks after its new rules took effect, the Netherlands watched the second fail on camera.

Sweden’s fix shows how much a regulator can do about the code. The Dutch test shows how little the same tools reach the door.

A Register Fix and a Register Failure, a Month Apart

On August 1, 2026, Spelinspektionen’s regulation SIFS 2026:3 took effect. It fixes how every Swedish licensee must query Spelpaus, the national self-exclusion register, so that each check is traceable to the operator that made it.

On September 1, Dutch broadcaster PowNed published a test. A reporter registered in Cruks, the Dutch self-exclusion register, then tried the doors of ten casinos and slot halls. The Kansspelautoriteit (KSA) called the result “a serious signal” two days later.

Neither regulator referred to the other. The two cases describe the same register design from opposite ends.

What Changed in Sweden on August 1

Swedish licensees were already obliged to check Spelpaus when a player registers, at every login, and before direct marketing. The regulation leaves those duties in place and changes how the check is done and how it can be proven.

Spelinspektionen’s impact assessment, published with the draft in September 2025, describes the gap. The register offers three APIs, one for login and two for marketing. No binding rule said which to use, and the regulator’s register data showed some licensees running every check through the same one.

A supervisory review closed in May 2025 found something worse. Licensees inside one group were querying the register with a single company’s credentials. In the register’s own data, several of the group’s licensees appeared to have performed no checks at all.

The regulation, decided on April 23, 2026, answers in three short provisions. A check counts as complete only when the register has returned whether the person is excluded.

Each licensee must use its own Actor ID and API key, even when a supplier runs the check. Marketing checks may go only to the marketing APIs. Registration and login checks go only to the login API.

The stakes are specific to Sweden. Just under 138,000 people were excluded through Spelpaus at the end of June 2026.

In its March 2025 review of unlicensed play, Spelinspektionen named self-exclusion as one of the two main push factors sending Swedes offshore. In its 2023 survey of excluded players, 41% had gambled during their exclusion. Of those, 37% had played on unlicensed sites.

That finding feeds two arguments. It supports the case that tight rules can push players toward unlicensed operators. It also fits Sweden’s trust gap and offshore drift.

The players most exposed offshore are the ones who asked for protection. A register that cannot prove its checks were made is a weak answer to them.

What a Television Crew Proved in the Netherlands

PowNed reporter Abel Bijlsma registered himself in Cruks for six months (the minimum), then visited ten land-based venues. At five, he showed his own passport or driver’s license. All five refused him, because the register returned a hit.

At the other five, he showed colleagues’ driver’s licenses. Three admitted him: Casino Be One in Rotterdam, Jack’s Casino in Utrecht and Holland Casino in Eindhoven. At Holland Casino, the resemblance was questioned and he was admitted anyway.

The KSA’s statement on September 3 drew the line precisely. Cruks works when a visitor shows their own document. What failed, in the regulator’s words, was the human work of access control.

The KSA said it was taking action toward the casinos and slot halls involved, which can lead to talks, extra checks or other supervisory measures. JA21 had already tabled parliamentary questions on September 2.

In a statement after the broadcast, Holland Casino said the check was more thorough than the video suggested. The reporter had explained that he had lost weight, and staff compared him with an older photo of the license holder on file.

A colleague was consulted where protocol called for escalation to security. The operator accepted he should not have been admitted.

No public response from Casino Be One or Jack’s Casino had been reported by early October 2026.

None of this was new to the regulator. Its slot-hall guidance on Cruks and identity checks, published on September 16, 2025, already lists a borrowed ID with an unchecked photo as a known signal.

The opposite failure has a price too. In 2023 the KSA fined Merkur Casino Almere €45,000 for admitting a registered player nine times after an error message.

Cruks held 111,534 registrations on January 30, 2026. The same day as its PowNed statement, the KSA also wrote to Dutch sports federations about prediction-market sponsorship, a gap the register does not reach.

Online Integrity Is an Engineering Problem: Venue Integrity Is a Process Problem

Online, every exclusion check is a query. It can be logged, timestamped, tied to a licensee and audited later.

Sweden’s reform did not add a check. It made every check attributable.

At a venue, the lookup is also a query. The Dutch guidance even requires a location code on each one.

What it cannot capture is the step before the query: whether the document belongs to the person holding it. That judgment lives in a person’s head, with a customer waiting.

The two surfaces fail differently. A technical failure is systematic and fixable with a rule and a code change. A procedural failure is intermittent and recurs however clear the guidance is.

The KSA had written this exact failure down a year earlier. It happened anyway.

This is a question of what each layer can be asked to do, rather than a case against venue staff.

Protection tools built into the account, such as reality checks, deposit limits and exclusion itself, run as code. At a venue door, the same protection depends on a member of staff.

Where Other Registers Sit on That Split

Table note: “technical surface” means the register is queried by software at account level. “Both” means a staffed physical entry point also has to recognize the person. Scope descriptions come from each regulator’s published rules; the OASIS count is as reported by hessenschau in February 2026.

Two patterns stand out. Jurisdictions that built one register for everything inherited the door problem with it. Those that kept the register online-only passed the problem to separate venue schemes, as Britain did, or left venues outside the register, as Australia did.

Denmark, whose register passed 60,000 registrations, and Britain, whose GamStop added a five-year auto-renewal option, sit on opposite sides of that choice.

What a Land-Based Door Check Would Have to Look Like to Match the API

The Dutch guidance already describes most of the answer. Read against the Swedish regulation, a door check that matched the API would need four properties:

• It cannot be skipped: The KSA lists an unstaffed entrance with no gate as a known failure. A gate that opens only on a completed lookup removes the choice.
• It fails closed: An error must mean no entry. That rule is in the guidance, and it is the statutory duty Merkur Casino Almere was fined for ignoring in 2023.
• The face match is not a judgment call: The guidance tells venues to protect membership cards against borrowing “for example by checking the photo properly or by using a fingerprint.” Any biometric binding means handling sensitive personal data at the door, so the lighter version is a photo comparison that is recorded rather than assumed.
• It leaves a record the regulator can read: Sweden’s whole reform was about attribution. A venue lookup is logged by location. A failed face match leaves no trace in the register.

Sweden found that advice had not changed operator behavior, so it wrote a rule. The Netherlands had already written the rule for the door.

The difference is that a rule about code can be enforced by the code. A rule about judgment can only be enforced by someone watching the judgment being made.

If gambling is causing problems for you or someone you know, help is free and anonymous. In the Netherlands, OpenOverGokken is available 24/7 on 0800 24 000 22. In Sweden, Stödlinjen is on 020-81 91 00.

Self-exclusion is available through cruksregister.nl in the Netherlands and spelpaus.se in Sweden.