Is Gambling Harmful? What New Zealand's 2026 Licence Framework Quietly Concedes

NZD 5 million. That is the pecuniary penalty the Department of Internal Affairs can now levy on anyone advertising unlicensed online casino gambling to a New Zealand resident, under the Online Casino Gambling Act 2026 that commenced on 1 May. A five-million-dollar fine is not a tidy regulatory housekeeping number. It is a number a government sets when it has concluded, on the public record, that the activity being advertised is capable of causing material harm to the people being advertised to. The question in the search box — is gambling harmful — is a question the DIA has already answered inside the Act itself. We went and read where.

Methodology

We read the Online Casino Gambling Act 2026, the DIA's published licensing framework, and the Cabinet decisions that preceded commencement on 1 May 2026. We then cross-referenced three overseas regimes the New Zealand framework structurally mirrors: the UK Gambling Commission in Britain, the Gemeinsame Glücksspielbehörde der Länder (GGL) in Germany, and Portugal's SRIJ. For each regime, we pulled the enforcement register, the responsible-gambling mechanism scope, and the operator filings that disclose how harm-minimisation obligations show up in financial statements. The UKGC's own public licence register lists 268 online operators and is our baseline, because the fifteen DIA licensees — to be issued from 1 December 2026 — will almost certainly include brands that currently sit on it. We did not interview officials. We did not survey players. We read documents and matched specific statutory language against specific disclosures. One limitation: the auction scheduled for September 2026 and the application files due in October are not yet public, so our inferences about which operators win are based on existing MGA and UKGC footprints only.

Finding #1: The Act's harm-minimisation clause is the thesis statement

Statutes do not accidentally embed harm-minimisation obligations. Those clauses are drafted by people who have already answered the harm question in the affirmative — the drafting choice is downstream of the finding.

The Act requires licensees to submit quarterly reports to the DIA, maintain documented harm-minimisation controls, and pay a dedicated offshore gambling duty earmarked at least in part for problem-gambling services. The parallel with the UK is close enough to be deliberate. In its FY2024 annual results, Flutter Entertainment disclosed that 47% of UK players had adopted a deposit limit by year-end, and that the mandatory reality-check default was set at 60 minutes — not because Flutter chose those numbers, but because the UKGC obliges them. Those are not marketing features. They are compliance line items on a regulated-markets P&L.

Here is the concession worth making early: a very large majority of recreational gamblers never experience material harm, and the industry's own aggregate numbers show that most sessions resolve within an entertainment budget. That is the strongest point the "it is just entertainment" view can make, and it is true at the median.

The rest of the Act dismantles the policy relevance of that median. If gambling were net-benign at the margin, the DIA would not require per-session reality checks, cross-operator self-exclusion, or quarterly behavioural reporting. The statute does not regulate chess clubs. It regulates this product in a particular way because the harm distribution is skewed, and the regulator has priced the tail.

Finding #2: The affiliate marketing ban is a harm admission, not a technicality

Cabinet agreed, before the Bill was finalised, to prohibit affiliate marketing and paid endorsements under the Act. Read that again. Not cap it. Not require disclosure. Prohibit.

This is unusual. The UKGC permits affiliate marketing under disclosure rules. The MGA permits it. AGCO Ontario permits it under its Standards for Internet Gaming. Germany's GGL imposes advertising caps and bonus restrictions but does not ban the affiliate channel outright. The DIA chose the harder line and chose it before the first licence was issued. The reason regulators treat affiliate marketing as the pointy end of the stick is specific and worth stating plainly: affiliate payouts optimise for conversion and lifetime value per acquired user, which means the economics incentivise the acquisition of players who deposit most and quit least. That cohort overlaps with the problem-gambling cohort more than the regulator can tolerate.

New Zealand did not need to make this choice. It could have copied the UK's disclosure regime. It did not, and the reason is written into the explanatory material: the Act is designed to minimise harm, and the affiliate channel was identified as a vector that worked against that purpose.

For readers tracking why this matters commercially: the ban means the first 15 DIA licensees cannot build their NZ book through the Trustpilot-style comparison sites, YouTube streamer deals, or Telegram-group CPAs that dominate the European acquisition stack. They have to use licensed broadcast and digital channels under disclosure rules. The cost of acquisition in NZ will be higher, and the compliance-adjacent spend higher still. That is not an accident of drafting either.

Finding #3: GAMSTOP, OASIS and GGL — what overseas registers tell us about the scale

If a product is harmless, the number of people who affirmatively exclude themselves from it in writing is approximately zero.

In the United Kingdom, GAMSTOP is the self-exclusion register that automatically binds every UKGC-licensed online operator. A single registration blocks deposits across all brands for a user-selected period of six months, one year, or five years. The published figure is 420,000 registered users. Annual registrations have grown 35% year on year. That is a population roughly the size of Christchurch choosing — on the record — to cut itself off from a legal consumer product.

Germany provides a sharper data point. Under the GGL, online casino players face a cross-operator monthly deposit cap of EUR 1,000. That cap is not advisory. The GGL's central system aggregates deposits across every German-licensed operator a user holds an account with and blocks further top-ups once the thousand-euro threshold is hit. A regulator does not build cross-operator deposit telemetry to protect people from a hobby. It builds it because the aggregate behavioural data told the government, before legislation, that unlimited-deposit online casino access correlated with specific harm patterns at national scale.

Portugal's SRIJ runs the Registo de Auto-Exclusão, which binds every SRIJ-licensed operator from a single registration. The architecture is the same. The design intent is the same. The DIA has read these registers, their underlying data, and the policy papers that produced them. The design of the New Zealand regime follows.

Finding #4: What UKGC enforcement files say about operators the DIA is about to license

The DIA will issue up to 15 licences, no operator holding more than three. The field of serious applicants is small, and we can name most of them from their existing UKGC and MGA footprints. We can also pull their enforcement files.

Entain paid a GBP 17 million settlement to the UKGC on 17 August 2022 for social responsibility and anti-money-laundering failings across its Ladbrokes and Coral brands. The published Regulatory Settlement is specific: Entain failed to carry out sufficient customer interactions with high-risk players, failed to identify players showing signs of problem gambling, and ran AML controls inadequate for customers with unusual deposit patterns. That is three distinct harm-identification failures in one settlement, from one of the two most likely NZ licence winners.

Flutter paid GBP 1.17 million on 2 March 2023 after the UKGC fined its Sky Betting and Gaming subsidiary for the same two deficiency buckets: social responsibility and AML. Bet365, through Hillside, paid GBP 582,120 in December 2022. The pattern is monotonous because it is causal: the operators that will build the NZ market have, within the last four years, failed to identify problem gamblers before harm materialised, in the regime most closely aligned with the one New Zealand is adopting.

Separately, in December 2023 Entain announced a GBP 585 million Deferred Prosecution Agreement with the UK CPS in relation to its former Turkey-facing business. That number is almost thirty-five times the UKGC settlement from the year before. The DIA is not writing legislation in a vacuum. It is writing legislation that assumes operators of this scale will, from time to time, require a NZD 5 million enforcement hammer within reach.

How the DIA regime compares to the registers it borrows from

What This Does NOT Prove

This piece does not prove that every person who gambles online experiences harm. The median recreational session resolves inside an entertainment budget, and the data in the overseas registers describes a skewed tail, not a population average. The piece also does not address land-based gambling in New Zealand — class 4 pokies in pubs, the SkyCity venues, TAB NZ retail counters — each of which has its own harm profile and its own regulatory file that we did not pull. We did not run a counterfactual on whether a looser regime (UK-style affiliate rules, no cross-operator deposit telemetry) would have been socially cheaper over a ten-year horizon, because the data to run that counterfactual honestly is not in the public domain. And we did not survey players. We read statutes, enforcement notices and annual reports. That is the method.

The Takeaway

The DIA has already decided gambling is capable of causing material harm — the Act's structure, penalties and affiliate prohibition are that decision expressed as legislation. If you are asking the question, the regulator has published the answer; you can read it in the clauses.

FAQ

Is online casino gambling currently legal for New Zealand residents in 2026?

Residents are not prohibited from playing on overseas sites, and have never been under the Gambling Act 2003 regime. What changed on 1 May 2026 is the advertising side. Under the Online Casino Gambling Act 2026, marketing unlicensed online casino gambling to a New Zealand resident now carries pecuniary penalties up to NZD 5 million, administered by the DIA. From 1 December 2026, up to 15 licensed operators will go live. Playing on a licensed operator will be the clean-market option; playing offshore is tolerated for the player, but the operator cannot promote itself here.

What harm-minimisation obligations will DIA licensees actually face from December 2026?

The Act's harm-minimisation framework requires each licensee to maintain documented controls, submit quarterly reports to the DIA, pay the offshore gambling duty, and integrate with the self-exclusion architecture the DIA is standing up. The exact technical specifications sit in secondary instruments due to be published alongside the first licence issuances. The structural parallel is the UK regime, where mandatory reality checks default at 60 minutes and documented player interactions on high-risk accounts are evidenced on inspection. Expect something close to that baseline, with the affiliate-ban carve-out that the UK does not have.

Why did Cabinet specifically ban affiliate marketing instead of regulating it?

Because the economics of the affiliate channel optimise for conversion and lifetime deposit value, which correlates with the acquisition of players who sit disproportionately in the harm tail. The UKGC and MGA address this through disclosure rules and conduct standards; the Cabinet decision for New Zealand took the harder line and prohibited the channel outright under the Act. The explanatory material frames this as a harm-minimisation design choice. Practically, it means the fifteen licensees cannot acquire NZ players through comparison sites, affiliate CPAs, or paid endorsements — a materially higher cost of acquisition than the UK equivalent.

How does the NZD 5 million penalty actually compare to overseas enforcement?

In isolation, NZD 5 million is below the top of what tier-one regulators have levied overseas. Entain settled with the UKGC for GBP 17 million in August 2022 on social responsibility and AML failings, roughly ten times the NZD cap in current-dollar terms. Bet365 paid GBP 582,120 in December 2022. The NZD 5 million figure is calibrated as an advertising-breach penalty under the Act, not as an operator-conduct ceiling, and the broader enforcement toolkit includes licence revocation, takedown notices, and the duty mechanism. It is a credible enforcement hammer for the regime's threat model.

Which overseas operators are most likely to win one of the fifteen DIA licences?

We will not know until the September 2026 auction and the October 2026 application files are public. The structural likelihood is that applicants will come from the pool currently serving New Zealand residents under MGA or UKGC licences — brands with existing operational infrastructure, segregated player funds, and a documented RNG and RTP certification history from bodies like GLI or iTech Labs. The DIA's cap of three licences per operator means at least five distinct corporate groups will emerge as licensees. The enforcement histories we quoted above will be in the DIA's file.

Does the Act regulate pokies in pubs or just online casino?

The Online Casino Gambling Act 2026 regulates online casino gambling specifically. Class 4 gaming machines in licensed venues — the pokies in pubs and clubs — continue under the Gambling Act 2003 and its existing harm-minimisation framework, including host-responsibility obligations on venue operators. SkyCity's land-based casinos operate under their own licence conditions. TAB NZ retains the domestic online sports-betting monopoly under its separate statutory framework. The 2026 Act is deliberately narrow in scope and does not consolidate those regimes.