Italy’s iGaming Shake‑Up: What Actually Changed?

Italy just pushed through its biggest online‑gambling refresh in about 20 years. Most of the changes landed in late 2025 and continue through 2026. In short: fewer operators, tougher rules, and a lot more oversight.

1. Licenses Got Really Expensive

Running an online gambling brand in Italy suddenly isn’t cheap anymore:

• The old entry fee (around €200k) jumped to €7 million.
• Licenses now last nine years and cover everything under one umbrella.
• On top of that, operators pay 3% of NGR every year, plus 0.2% to the responsible‑gaming fund.

Italy basically raised the bar so only serious operators stick around.

2. No More Multi‑Skin Websites

As of November 2025, the “skin model” is gone:

• One license = one .it website + one app.
• The whole market shrank from 400+ sites to just 52.

It’s a headache for marketers but a relief for regulators who were drowning in duplicated brands.

3. Stronger Player Protections (2026)

Several new safety features are being phased in:

• Players must set deposit and time limits.
• Operators now use AI‑style tools to spot risky behavior.
• From February 2026, players can block only certain game types (e.g., slots) instead of the entire account.
• SPID / digital ID becomes the default way to verify users.

Overall: a much tighter system aimed at stopping abuse before it starts.

4. Small Tax Hike

Not huge, but still relevant:

• Casino / poker / bingo tax goes to 25.5% GGR
• Sports / virtual betting tax goes to 24.5% GGR

5. The New “Checksum of Checksums” Rule

This is one of the more tech‑heavy updates, but here’s the simple version:

Instead of checking each file one by one, Italy now wants operators to:

1. Generate a checksum for every file (game files, binaries, configs, etc.)
2. Then create one big checksum that represents all of those smaller checksums together.

Think of it like a “master fingerprint” for a whole module:

• Each file has its own hash.
• All those hashes get hashed again.
• ADM can then quickly check if anything in that group was altered — even tiny changes break the master checksum.

Along with that, operators must also keep:

• cryptographic digests,
• compilation logs, and
• test reports

all bundled as one integrity package. It’s basically a cleaner, harder‑to‑cheat version of the old system and less time consuming for the validators.