The draft rule in plain language
The draft, published as Bekendtgørelse-udkast 1042/2026, has two legs. The first requires MitID step-up authentication at the point of any SEPA deposit or withdrawal on a Spillemyndigheden-licensed site, beyond the existing registration-time identity check. The second mandates that Danish ISPs apply DNS-level resolution blocks to a list of 40+ offshore gambling domains maintained by Spillemyndigheden and refreshed quarterly.
The first leg targets fraud and account takeover. The second leg targets channelization. Spillemyndigheden has framed both as flowing from the same risk picture, where a Danish player who never confirms identity beyond registration may not actually be the account holder, and where offshore access remains too easy even for players nominally inside ROFUS.
How MitID verification will change
Today, a Danish licensed operator checks identity at account opening and triggers enhanced due diligence at AML thresholds. The draft rule moves identity confirmation to every individual SEPA transaction above DKK 500, using MitID's step-up flow that already exists for banking.
Operators have told us the technical lift is manageable but the friction cost is not. A Danske Spil representative, speaking on background, said real-money deposit completion rates typically fall 8% to 12% when a MitID step is added to a funnel. 'We will comply,' the person said, 'but the regulator should understand the channelization cost that comes with it.'
The expanded DNS block list
Spillemyndigheden already runs a court-ordered DNS block list targeting a core group of offshore brands. The draft expands the list to 40+ named domains and makes the quarterly refresh automatic, rather than requiring fresh court orders for each addition.
ISPs including TDC, Telia and Telenor would be required to apply the blocks at the resolver layer, with a notification page served to Danish users who try to reach a blocked domain. The notification would include a link to ROFUS and to Spillemyndigheden's licensed-operator register. The draft is silent on VPN-mediated access, which remains the obvious circumvention route.
Consultation timeline
The consultation window closes on 15 January 2027. Spillemyndigheden has committed to publishing all responses, a change from past consultations which were summarised rather than disclosed. The formal rule is targeted for Q2 2027 with a six-month implementation window, which would put operational enforcement around late 2027.
Three Danish licensees have already signalled they will file objections on the SEPA step-up requirement. The ISP-level block, by contrast, has broader cross-industry buy-in, since it does not touch the licensee's own funnel.
What Danish players losing offshore access can do
The honest answer is that the licensed Danish market is still the first option worth checking. Payout speed is competitive by European standards. Our Danish rankings cover which licensed brands are actually paying out fast and which are slow enough to notice.
For players who have been using offshore brands and will lose easy DNS access, the legal position has not changed. Playing at a non-DK-licensed site from Denmark is not criminal for the player, but it is unsupported by Danish consumer law, and ROFUS self-exclusion does not reach there. A VPN will circumvent the DNS block technically, but routes you outside Danish consumer protection entirely.
Legal pathways and challenges
Expect a challenge on the SEPA step-up requirement under the Payment Services Directive. PSD2 has limits on how much friction a merchant can layer onto a SEPA flow, and gambling-sector rules on top of banking authentication are a live legal question. Danish legal commentators have flagged this in the first wave of responses to the draft.
The DNS block expansion is more defensible under settled Danish administrative law. Spillemyndigheden has run DNS blocks since 2012 and the courts have consistently upheld the enforcement mechanism. The shift from court order to administrative refresh is the technical change most likely to draw a procedural challenge.
Frequently asked questions
Will I need MitID for every casino deposit?
Under the draft, yes, above DKK 500. The step-up flow is the same one Danish banks already use. The rule is not final until Q2 2027 at the earliest.
Can Spillemyndigheden actually block offshore sites?
DNS-level blocking at Danish ISPs is already in place for a core list of offshore operators. The draft expands the list to 40+ named domains and automates the refresh.
Is it illegal to use an offshore casino from Denmark?
No. Playing at a non-DK-licensed site is not criminal for the Danish player. It is, however, outside Spillemyndigheden's consumer protection and outside ROFUS.
Does ROFUS reach offshore operators?
No. ROFUS only binds Spillemyndigheden-licensed operators. Self-exclusion does not cross the border.
Olivia Clarke
Olivia Clarke runs Flinke's UK and Ireland desk and edits the newsroom. Nine years deep in the regulated British market, she tests every operator we rank by signing up as any player would, running real deposits through the cashier, and timing withdrawals from click to cleared funds.
About the desk ›