Sweden Made Self-Exclusion a Real-Time API Problem

On 1 August 2026, a Swedish compliance obligation quietly stopped being a policy question and became an uptime question. SIFS 2026:3 — decided 23 April, published 29 April, in force since the start of this month — sets out how licensed operators must connect to and query Spelpaus, Sweden’s national self-exclusion register. The substance of the duty is not new; Swedish licensees have always had to keep self-excluded players out. What changed is the mechanics: the check is now a credentialed API call, made at defined moments, by a named licence holder.

That sounds like an integration detail. It is closer to an architectural one, and the operators who treat it as a ticket for the platform team are the ones who will discover the problem in a supervisory review rather than in a sprint.

What the regulation actually requires

Strip the framework down and there are three moving parts.

Credentials. Every licence holder receives its own Actor ID and API key from the regulator, and both are mandatory on every query. This is the design decision that carries the most weight. Because the credential belongs to the licensee rather than to whichever platform is making the call, every check is traceable to a named regulated entity — which is what turns the accountability rule into something a supervisor can actually test.

Trigger points. A check — kontroll — must be run before direct marketing goes out, when a new player registers, and when a player attempts to log in. Sweden has deliberately separated these across a dedicated marketing API and a distinct login-and-registration API, so an operator cannot satisfy one obligation with the other’s plumbing. Each path has to be wired, monitored and evidenced on its own.

Accountability. The regulation states plainly that responsibility remains with the licence holder even where the technical checks are delegated to a third-party service provider. That single sentence is the most commercially significant line in the document.

The line that matters most is about somebody else

Most Swedish licensees do not run their own player-account platform. The check will be executed by a platform provider, an aggregator or a managed-services vendor, using the operator’s credentials, inside infrastructure the operator does not control. And the regulator has pre-emptively closed the obvious defence: the licensee is answerable regardless.

This is the same principle European regulators have been converging on from several directions at once — that a regulated party cannot contract its way out of a regulatory duty by handing the mechanics to a vendor. The UK’s regulator has been making a structurally identical argument about white-label arrangements and where AML liability really sits: the licence holder owns the obligation, whoever operates the machinery. Sweden has now written the same idea into a technical standard, which is a more enforceable place for it to live than a guidance note.

The practical consequence for an operator is a contractual one, and it needs doing now rather than at renewal. If your platform provider executes Spelpaus checks on your behalf, your agreement should specify who monitors the integration, what happens on a failed or timed-out call, how long check records are retained and who produces them under supervision, and what the notification path is when the interface degrades. Very few platform contracts written before this year address any of that, because until 1 August the check was not a live dependency.

Where the specification runs out

The awkward part of SIFS 2026:3 is not what it demands but what it does not yet supply. Industry reporting on the regulation notes that it lacks detailed API specifications, response formats and service performance standards — precisely the material an integration team needs to build something resilient rather than something that merely works on a good day.

So the obligation is live and the engineering contract behind it is incomplete. There is no way to read that as anything other than an asymmetry in the operator’s disfavour, and the honest advice is to build for the version of the rules that will exist in twelve months rather than the one documented today: idempotent calls, explicit timeout handling, full audit logging of every query and every response including failures, and a retention period long enough to answer a supervisory question about a session six months old. None of that is expensive to build up front. All of it is expensive to retrofit under a regulator’s timetable.

The part that travels

SIFS 2026:3 binds Swedish licensees and nobody else. Its interest to operators outside Sweden is as a template, and the template is unusually portable.

Most player-protection reform requires new primary legislation and a multi-year political cycle. This one does not: a jurisdiction that already runs a national self-exclusion register can move it from periodic reconciliation to a mandatory real-time query with a technical regulation and a set of API keys. Sweden has now shown the pattern end to end — credentials per licensee, separate interfaces per trigger, and accountability pinned to the licence rather than the integrator. Regulators watch each other closely on player protection, and this is the kind of measure that reads well politically, costs the regulator relatively little, and pushes the implementation burden onto licensees.

For operators weighing markets, that is worth folding into the calculation now. The visible costs of a Tier-1 European licence — fees, capital, substance — are the ones everybody models. The compliance-engineering cost is the one that keeps arriving after the licence is issued, and it does not appear on any fee schedule. It is a genuine part of the offshore-versus-onshore trade-off, and we lay out the rest of that comparison in the offshore vs onshore breakdown and in the best gambling licences guide. If you are already tracking obligations landing across several regimes this year and next, they are collected in one place in our gambling licence deadlines calendar.

What to do this month

If you hold a Swedish licence: confirm your Actor ID and API key are issued and in use on both interfaces, verify that all three trigger points fire independently, write down your outage policy, and open the contractual conversation with whoever runs the integration on your behalf. If you are considering Sweden: price the engineering, not just the licence.

Sweden is not alone in loading obligation onto the operating side rather than the licence itself — Italy’s AGCOM communication rules do the same thing to marketing, and are worth reading alongside this if you run both markets.

And if the broader question on your desk is which regime your compliance budget can actually carry, that is the conversation we have with operators every week. Compare the regimes side by side in the Licence Finder, or book a free consultation — we will be straight about which markets are worth the build.

Iryna H.

Gaming Licensing · Vantegris

Part of the Vantegris desk that runs these licences end to end — writing from live applications across 40+ jurisdictions, not recycled marketing. Reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.