Access all areas: Why Videoslots strongly contests the KSA's use of ‘mystery shopping’

The use of ‘mystery shopping’ sparked a fierce debate in March when Videoslots was unexpectedly hit with a €9.9m fine by the Netherlands Gambling Authority, or the Kansspelautoriteit (KSA), for violating the country’s Betting and Gaming Act by offering online gambling without a licence. 

The enforcement decision by the KSA, dated 20 December 2022, stated that the regulator investigated videoslots.com on 4, 5 and 12 April 2022 and found the website was accessible from a Dutch IP address. The KSA was able to create an account with Dutch address data, log in to make a deposit and play games of chance by selecting Germany at the registration stage.

In addition, the enforcement decision document reads that when registering, a button was present with the text ‘Register with iDIN’, a service used by Dutch banks allowing consumers to sign up with other organisations using their own bank ID. Finally, a credit card linked to a Dutch bank account was used to make a deposit of €10 into the Videoslots account, while instructions about the payment were partly displayed in Dutch.

The KSA’s investigation was prompted by a CasinoNieuws.nl article on 1 April 2022 stating online casino operator Videoslots had recently added the Loket Kansspel logo (the central support point in the Netherlands for seeking help for problem gambling) and wording of ‘permit holder of the gaming authority’ to its site.

Ewout Wierda, general counsel of Videoslots, details to EGR Intel the chain of events that followed. “Within our group, we had applied for a licence two or three days before, which is why the logo was there. When you apply for a licence, you are supposed to be certified for having everything in place to fulfil the requirements. One such requirement is that you display that logo. So, you need to have a test site where the auditors can see the logo is there. Then they certify you, in part for that, as complying with the rules and that certification goes into the licence application,” he explains.

However, a developer mistakenly put the logo, wording and iDIN button on the Videoslots live site instead of a test version, unbeknown to the operator at the time. At this point, Wierda would have expected to have been contacted by the KSA directly. “The first inkling they should have had is that it’s a mistake and these people are not intent on bypassing the licensing system. A number of people who work there, even senior people, have my mobile number. They could have WhatsApped me to say, ‘get that logo off your site’. And I would have apologised profusely for the developer’s mistake. In the fastest time possible, it would have been offline.”

A few weeks later, Videoslots received a letter from the KSA saying it had investigated the site, managed to access it and gamble online. In addition to a registration block where you cannot select the Netherlands in a dropdown menu as a country of residence or a country code for a Dutch telephone number, the online casino firm then also added IP-based interface blocking as an additional security measure to prevent this from happening again.

In Wierda’s opinion, though, interface blocking is easier to evade by simply setting up a VPN and, once your IP address is no longer showing as being in the Netherlands, you have full access to a site. He insists registration blocking is still effective and normal practice in the online gambling industry. “Because when someone registers, as the KSA did in this case, pretending to be a German customer, sooner or later we’ll look at that account. When we see someone pretending to be German, we call that fraud, and we take steps accordingly.”

A source with a close understanding of the industry believes, in the Videoslots case, the manner with which the KSA carried out the investigation was “a bit childish” because the operator had taken measures, albeit inappropriate measures in the eyes of the regulator. However, he acknowledges that most operators already use an IP block to restrict play from the Netherlands.

“It’s the responsibility of the operator to ensure players from the Netherlands do not get access to a locally unregulated offering. The way you do it, whether it’s through an IP block or other measures, is totally irrelevant. There’s nothing in the law that says you need to have an IP block. But you could also say, if you do not have an IP block, which is the weapon of choice for most operators, you’re taking a certain risk, and that risk has now materialised,” he comments.

In response to the fine announcement, Ulle Skottling, deputy CEO at Videoslots, said at the time: “It is absurd that the KSA should fine us after gaining unauthorised access. It is simply not possible to protect fully against unauthorised access, and the KSA has no guidelines on what measures are sufficient.”  

Under investigation  

As a regulator, the KSA tells EGR Intel that it has a special legal authority to create an account and investigate whether it is possible to play at a casino operator not licensed in the Netherlands. However, it does not consider this mystery shopping but rather “a special authority for special purpose”. Despite this, the KSA’s chair René Jansen has used the term “mystery shopping” in several speeches in the past, namely one in December 2019 as well as in a blog in August 2021.

Despite the KSA not using the wording “mystery shopping”, Roelien van Neck, partner at Bird & Bird (Netherlands) LLP, points out it is not a legal term but a colloquial one to describe certain powers that Dutch regulators, as well as those in other countries, have been given. “A similar power has been granted to the KSA, but also other Dutch regulators have it, like the consumer and financial regulators, and that is to see whether a company is in compliance with the law,” she explains.

Yet Videoslots argues in its defence that the power was not used in this way to check compliance. Representing the operator in its objection of the fine, van Neck explains the KSA investigator used partially incorrect information but not to see whether there was compliance. “They did it to break through the technological measures of Videoslots. And that is, in our view, beyond the powers of the KSA.

“Mystery shopping should only be done as a last resort. So, if no other measures are possible to check whether there’s compliance. In our view, the KSA has already breached its powers because it could have just picked up the phone to ask what was going on,” she says.

When it comes to the mystery shopping method used, Videoslots believes the KSA went beyond the powers of what it is permitted to do. When the regulator attempted to register on the Videoslots site, it was immediately blocked, as the operator recognised the person as a Dutch resident. The KSA subsequently selected Germany instead, a country where Videoslots is permitted to offer online gambling, and was, ultimately, able to gain access that way after listing further incorrect information.

Van Neck believes this is no longer mystery shopping. Instead, she argues that when the KSA was barred at the first step, it should have realised there were measures in place, whether it registered as the KSA or ‘Mr John Doe’, and was therefore not permitted to play on the site. She explains: “Various steps in the process were taken, but each time the KSA was blocked. But at the last stage, they were able to come through and then they were participating. This was after being blocked on numerous occasions, and each time they had to do a little trick to get through the system of Videoslots.”

Setting boundaries

On the other side of the argument, the anonymous source who spoke to EGR Intel on the mystery shopping element struggles to think of an alternative way the KSA could have checked whether a Dutch player was able to access the site. He also isn’t sure whether the regulator overstepped its legal boundaries.

“I’m not sure whether it is called entrapment,” he asserts. “Just imagine if the regulator would allow any operator without a local licence to leave the door open for Dutch players. As long as they do not fill out the Netherlands on a dropdown menu upon registration then, of course, the whole rationale of local licensing would be totally pointless.

“Because every operator out there would simply say, ‘well, let’s take out the Netherlands from the dropdown menu. We basically accept that we have players from the Netherlands who fill out untruthful information about their place of residence’. That, of course, would undermine the whole concept of local regulation. So, from that perspective, the position of the gambling authority is understandable.”

Whether the way the KSA investigated Videoslots is branded as mystery shopping, entrapment or hacking, as some in the industry have suggested, the operator’s objection to the fine comes down to its belief that the regulator acted unlawfully by gaining unauthorised access to its site. “We obviously had no intention for them or anyone else to get through, and therefore mystery shopping as their legal power did not apply to the situation because by doing something illegal, they made us do something that we never intended to do. Now, if that is not unlawful, I don’t know what is unlawful. It’s scary for the whole industry,” Wierda divulges.

While the Netherlands Gambling Authority says it has special powers to investigate such matters if deemed necessary, Bird & Bird strongly argues the regulator doesn’t have the authority to mislead operators by pretending to be a resident of a different country. “So, there is a discussion on whether the KSA was permitted to do this. You can of course have a debate on whether this comes under mystery shopping or not. But what is clear, however it’s called, is that this is an overstepping of the boundaries by the KSA,” van Neck points out.

The KSA is reported to have used mystery shopping tactics previously to check compliance by operators, but only if there is no other way to exercise its tasks as a regulator. The unnamed source elaborates: “So, is there another way they can find out? Just imagine if they didn’t have these powers. Then it will be very easy to circumvent the legislation because everyone would think ‘the gambling authority can’t check on us. Why would we bother to comply with the law?’ So, it serves a purpose.”

Under article 34(c) of the Betting and Gaming Act, KSA officials are entitled to participate in remote gambling by providing incorrect or incomplete information relating to their identity, to the extent reasonably necessary for the performance of their duties. By law, the KSA is permitted to conduct an investigation using its own name and a KSA email address or by adopting a fake identity. However, what Videoslots disputes is the KSA pretending to be from a country where the operator is allowed to offer online games, but then turning out to be from the Netherlands.

Wierda of Videoslots feels strongly about the ethics surrounding the KSA investigation and believes authorities should be demonstrating the importance of the rule of law. “I find the integrity of that, the ethical aspect of it, quite shocking to be honest. You see that authorities naturally have a tendency to push the envelope of the rule of law to their convenience,” he says.

Another area of contention for Videoslots is how the investigation was carried out, as Wierda insists mystery shopping should be about doing “what consumers do without showing that you’re not a consumer but the authority”. He adds: “In fact, they did not do what consumers normally do. We don’t have any consumers that were found to have done the same as the KSA. We submitted evidence to that effect. We had zero deposits. We couldn’t find anyone with Dutch nationality who had placed a bet.”  

Target practice

On the point that Videoslots wasn’t targeting the Netherlands, Bird & Bird says there were various technological measures in place to bar traffic from the country. “That was successful because there were no players. The only player was actually the KSA person,” adds van Neck. The operator also claims the criteria for targeting was not met as the site did not have any reference to the Netherlands, for example no colour orange or a .nl top-level domain.

However, the KSA’s counterargument is that there is targeting even if it is international targeting. According to Bird & Bird, the KSA counts a company as targeting the Netherlands when accepting euro deposits, international payment methods such as Mastercard and Visa, and the use of the English language since most Dutch people speak/understand English. “We of course contest that, as we stated it’s a far too wide interpretation. Because it basically means the KSA becomes the police of the entire euro region,” remarks van Neck.

Videoslots’ general counsel calls this expanded concept of targeting “a double-edged sword”. “You can’t avoid being seen as targeting and being seen as making access possible. Because there are no technical measures that make access impossible,” Wierda explains.

On the other hand, the anonymous source highlights that the prioritisation criteria is “utterly irrelevant” and “old news” since the regulated online market opened in October 2021. “Today the situation is, do you accept Dutch players? Yes or no? And we don’t care whether you use English, Dutch or another language.”

Now Videoslots has submitted its written objection to the KSA, the next step is to await the regulator’s decision. Depending on the result, the operator can go to court to appeal the outcome and, if necessary, lodge a further appeal. “We will take any remedy available. We really will go as far as we can, and do whatever it takes,” Wierda asserts.

In reply to the opinions expressed in this article, Videoslots provided the following response to EGR Intel: It is our responsibility as an operator to avoid actively entering a properly regulated jurisdiction, by demonstrating our intention. This is a matter of targeting, which regardless of changed local Dutch views, continues to be of core relevance under EU law. Targeting is not as such established by access, language or currency, as even the old prioritisation criteria expressed. Where a jurisdiction is not targeted, the national laws of that jurisdiction simply do not apply, as is recognised elsewhere in the EU.

The KSA itself evidenced that we clearly disallowed and restricted access to Dutch consumers and used the official language and currency of Malta, our EU member state of establishment. This proved that we did not intend to target the Netherlands, and cannot reasonably be seen as undermining the rationale of local licensing. Once the KSA established that we had not crossed the virtual border of the Netherlands, it had nothing further to check or enforce. Therefore the KSA had no reason or legal grounds whatsoever to evade restrictions and gain unauthorised access, or to find out in some other way if consumers actively crossing the virtual border could gain access or acceptance. Moreover, even under the mystery shopping provision in Dutch gambling law the KSA had no power to force us into an alleged violation that was evidently contrary to our intent.

It is wise for a cautious operator to follow excessive local expectations as a matter of courtesy, but these should be feasible and clear in sufficient detail. The KSA should not expect access to be impossible, as that is technically not doable. The KSA itself evidently believes that the type of restrictions applied are relevant and it should have clarified this, but instead it enforced against registration restrictions that some other countries consider the weapon of choice. While the restrictions considered relevant by the KSA in enforcement practice are easily circumvented, filling in false details cannot be accepted by operators complying with strict gambling regulations and anti-money laundering obligations. Therefore the possibility of player fraud does not imply acceptance of consumers circumventing restrictions.

EGR Intel requested an interview with the KSA but received no response.