The Hellenic Gaming Commission (EEEP) has kicked off a targeted public procurement process under Tender Notice 2/2026, seeking a specialised legal and technical partner to redesign the structural framework governing Electronic Player Accounts (EPAs) across licensed gaming platforms in Greece. The initiative centres on modernising Know Your Customer (KYC) architectures to tighten identity verification, combat underage gambling, and close gaps in digital fraud prevention. It marks one of the most concrete regulatory moves Greece has taken toward harmonising its online gambling compliance infrastructure since the market’s formal licensing regime took shape.
What the EEEP’s Procurement Signals for Greek iGaming
Before unpacking the specifics, it helps to frame what this procurement actually represents. Greece isn’t simply updating a policy document. The regulator is contracting external expertise to audit, restructure, and standardise how every licensed operator handles player identity from account creation through ongoing verification. That distinction matters, because it suggests the current EPA framework has been found wanting (a point the EEEP has not stated explicitly, but one the procurement’s scope makes difficult to ignore).
- Regulatory ambition is escalating: The EEEP is moving beyond enforcement-only postures toward proactive infrastructure design, signalling a more hands-on approach to how operators manage player data.
- KYC standardisation could reshape operator costs: A unified EPA framework would likely require operators to align their verification systems with new technical benchmarks, potentially increasing short-term compliance spend but reducing long-term regulatory friction.
- Licensed platforms may face tighter onboarding requirements, with implications for conversion rates and player acquisition timelines.
- Anti-fraud and minor protection sit at the core: The emphasis on identity fraud and underage play prevention positions this overhaul as both a consumer protection and market integrity measure.
- The consultancy contract structure, capped at a defined ceiling, suggests the EEEP wants focused, time-bound deliverables rather than an open-ended advisory engagement.
Why KYC Architecture Matters More Than It Sounds
KYC is often treated as a checkbox exercise in industry conversation. Verify the player’s identity, confirm their age, move on. But the architecture underneath those checks determines whether an operator can detect synthetic identities, flag duplicate accounts across platforms, or catch document manipulation in real time. Greece’s existing framework, built during the initial rollout of its licensing regime, arguably hasn’t kept pace with the sophistication of fraud tactics now common across European markets.
The EEEP’s decision to bring in external legal and technical advisors rather than handle the redesign internally tells us something. Regulatory bodies across Europe have increasingly acknowledged that the technical complexity of modern digital identity systems exceeds their in-house capacity. The UK Gambling Commission, Malta Gaming Authority, and Dutch Kansspelautoriteit have all, at various points, relied on external consultancies to stress-test or redesign elements of their compliance frameworks.
Greece appears to be following that playbook. And while the procurement is structured as advisory, the outputs will almost certainly feed into binding regulatory updates that operators must implement.
Operational Impact on Licensed Operators
For operators holding Greek licences, the practical question is straightforward: what changes, and when?
The answer depends on what the contracted partner recommends, but several outcomes are plausible based on the procurement’s stated scope:
| Area | Current State | Likely Direction |
|---|---|---|
| Account creation verification | Operator-determined processes within broad regulatory guidelines | Standardised verification steps mandated by EEEP, potentially including biometric or multi-factor requirements |
| Ongoing due diligence | Periodic checks, largely triggered by transaction thresholds | Continuous monitoring models with automated risk scoring |
| Cross-platform identity checks | Limited interoperability between operator systems | Centralised or semi-centralised identity registry enabling duplicate detection across licensees |
| Minor protection | Age verification at onboarding | Enhanced verification layers, possibly including parental consent mechanisms for edge cases |
Not all of these will materialise. Still, the direction of travel is clear enough that operators would be wise to begin internal audits of their own EPA systems now rather than waiting for the final regulatory output.
How This Fits Into Europe’s Broader Compliance Trajectory
Greece’s move doesn’t exist in isolation. Across the EU, regulators are converging on a shared recognition that player account frameworks built five or six years ago are no longer adequate. The Hellenic Gaming Commission’s procurement initiative echoes similar efforts in jurisdictions where digital identity fraud has outpaced legacy verification systems.
Germany’s interstate treaty framework, for instance, has faced persistent criticism for its fragmented approach to player verification. Italy’s ADM has invested in centralised self-exclusion and identity systems that, while imperfect, offer a template for cross-operator data sharing. What Greece is attempting sits somewhere between these models: a regulator-driven redesign that could, at least on paper, leapfrog the patchwork approaches seen elsewhere.
Whether the EEEP achieves that ambition depends heavily on the partner selected through this procurement. The quality of the legal and technical advisory work will determine whether Greece ends up with a genuinely modern EPA framework or simply a more detailed version of what already exists.
A Broader Question of Regulatory Capacity
There’s a subtler dimension here worth noting. When a regulator outsources the redesign of a core compliance architecture, it raises questions about long-term institutional capacity. The EEEP is not unique in this regard. But the pattern across European gambling regulators of relying on external consultancies for foundational technical work suggests a structural gap that the industry hasn’t fully reckoned with.
Frequently Asked Questions
What is Tender Notice 2/2026?
It is a specialised public procurement notice issued by Greece’s Hellenic Gaming Commission seeking a legal and technical consultancy partner to overhaul the Electronic Player Account framework used by licensed online gambling operators.
Will this affect all licensed operators in Greece?
Yes, any regulatory changes resulting from this initiative would apply across all platforms authorised to operate under Greek gambling law. The timeline for implementation, however, remains undefined at this stage.
What specific problems is the EEEP trying to solve?
The procurement focuses on identity fraud prevention, underage gambling safeguards, and the standardisation of KYC processes across licensed platforms. The EEEP has not publicly detailed specific failures in the current system, but the scope of the overhaul implies material gaps have been identified.
How does this compare to other European regulators’ efforts?
Several EU regulators have undertaken similar modernisation projects. Italy and the Netherlands have both invested in centralised identity and self-exclusion systems, though approaches vary significantly in scope and technical ambition.
