The rising complexity of fragmented compliance

Built for rules that keep changing

We chose to speak with Internet Vikings because they are one of the few infrastructure providers built specifically around the needs of licensed iGaming operators, with hands‑on experience hosting in multiple regulated markets across Europe and the US.

Founded in 2007 as a hosting and domains business, the company has evolved into a specialist provider of compliant, in‑state hosting for regulated operators, giving them a front‑row view of how fragmented rules shape day‑to‑day operations.

A decade of regulatory whiplash

Recent years have brought waves of change to gambling regulation across Europe and North America, driven by stricter compliance requirements, higher taxes, and evolving interpretations of “reasonable measures.”

Several countries have revised their gambling acts—or introduced entirely new ones—with fresh limits on advertising, payment methods, data retention, and tax rates.

Even established markets like the UK, Netherlands, and Malta continue to adjust core frameworks, raising the bar for player protection and financial oversight.

When we sat down with Rickard at Internet Vikings to discuss this landscape, he quickly pinpointed the heart of the issue: fragmentation. Almost every country that has legalized gambling—and, in the US, every state that is legalizing gambling—now applies its own regulatory and compliance framework.

Operators and suppliers no longer face a single strict rulebook, but dozens of partially overlapping ones that can pull in different directions. The same product may need different technical controls, logging standards, and risk thresholds depending on where the player sits, even when the underlying policy goal is similar.

EU patchwork, US mosaics

Legal standards meeting technical reality: defining “reasonable measures” in an environment where every control can be bypassed, yet regulators demand stronger barriers and better detection.

“Reasonable measures” and the limits of blocking

Few phrases have caused more disagreement between operators and regulators than “reasonable measures”.

On paper, the concept is simple: licensees must take reasonable steps to prevent underage, excluded, or out‑of‑jurisdiction players from accessing their sites.

In practice, Rickard argues, there is always a way around any single technical barrier if a player is determined enough and technically capable.

The challenge, then, is not to create perfect walls but to spot patterns.

Infrastructure can flag when a thousand players suddenly appear behind the same VPN endpoint, or when suspicious clusters behave in ways that differ from the ordinary customer base.

Rickard compares the situation to Netflix: in the early days, it was relatively easy to watch a foreign series while on holiday, but as rights and obligations tightened, so did the geofencing.

The difference is that gambling carries higher stakes — financial, social, and political — and therefore attracts more aggressive attempts at circumvention.

The only way to make access nearly tamper‑proof, he notes, would be to demand precise geo‑coordinates from every player device and lock play to those coordinates in real time. Technically, this is increasingly possible.

Legally and ethically, it collides with privacy laws and with a basic sense of proportionality in how far a state should go to supervise an individual who is, at least on paper, playing on a legal site.

New rules are likely to push this debate further. Operators and their partners are increasingly expected to block access from sanctioned or high‑risk jurisdictions, and from customers caught by EU or US sanctions regimes, even though VPN use and proxy traffic can blur the line between ordinary travellers and prohibited players.

In Sweden, a new Sanctions Act and the government memorandum “Spellagens tillämpningsområde, Ds 2025:23” would expand the definition of illegal gambling and tighten payment‑blocking duties for firms that facilitate unlicensed play, again rewriting parts of the rulebook Rickard is responding to.

When doing everything “right” is not enough: compliance depends on systems that can adapt to different logging, monitoring and audit requirements across regulators, not just on a single static rulebook.

When doing everything “right” is not enough

The goal, in his framing, is a system in which the overwhelming majority of activity is correct and where slips are containable, documented, and fixable rather than symptoms of deeper flaws.

For supervisors, the key question becomes whether they are seeing isolated, explainable issues or evidence of systemic weakness. This is where hosting and infrastructure turn political: they determine what is logged, how long data is retained, how quickly anomalies can be spotted, and how easily a regulator can reconstruct events years later.

Internet Vikings has positioned itself precisely in that space. Rather than acting as a generic cloud supplier, it tries to understand why one authority cares about one set of logs, another about a different audit trail, and a third about real‑time monitoring — and to build platforms accordingly.

In Rickard’s view, the only sustainable answer to fragmentation and shifting interpretations of “reasonable measures” is to engineer systems and partnerships so that they can be demonstrated under scrutiny, not just stated in a policy document.