Israel - legal status and risks

(Section: "Markets and Jurisdictions")

1) Market picture and basic principle

• Mifal HaPais is a national lottery and instant draw.
• Israel Sports Betting Board (Toto/Winner) - sports betting in a regulated format.
• Private casinos/slots/poker offline and online are not allowed. Any activity outside of state exceptions is considered illegal and entails administrative and/or criminal liability.

2) Authorities and areas of responsibility

Specialized ministries and state operators - lottery and sports betting policy; contractual framework with the agency network.
Tax authorities - administration of corporate taxes and fees from authorized operators.
IMPA (AML/CFT) is an Israeli anti-money laundering and terrorist financing authority: methodology, STR/SAR, data exchange.
Law enforcement agencies and courts - suppression of illegal sites/organizers, sanctions, blocking.
Supervision of communications and the payment system - execution of orders to block domains/applications and suppress payments in favor of unlicensed operators.

3) What is allowed and what is forbidden

It is authorized

Mifal HaPais products (lotteries, instant lotteries) according to approved rules.
Toto/Winner sports bets within the framework of the state mandate (offline points and official online channel).

Forbidden

Casinos (offline), online casinos/slots/poker, betting exchanges, casino bots/telegram schemes, "social casinos" with signs of gambling.
Any private B2C operations without government exception, including "offshore" services aimed at the audience of Israel.
Advertising and affiliate promotion of illegal brands for residents.

4) Block measures: domains, applications, payments

Domain/IP/URL locks are executed according to judicial and administrative orders: communication providers are required to restrict access to illegal resources, including mirrors and mobile applications.
Payment restrictions: banks/PSPs are required to suppress transfers in favor of unlicensed operators; risk models according to MCC/transaction patterns, monitoring of "pseudo-merchants," chargeback cards are used.
Blacklists of domains/resources are regularly updated; bypasses (CDN rotation, proxy chains, crypto converters) are interpreted as an aggravating circumstance.

5) Taxes and fiscal reporting (high level)

State operators and their agents comply with separate fees/deductions in favor of the budget and public programs; contractual reporting and auditing is in effect.
Corporate taxes - according to the general regime; VAT does not apply to bets/winnings, but applies to related services (IT, hosting, marketing, outsourcing).
Separate accounting by products and channels, transparent reflection of bonuses/void/cashout (if applicable within the permitted products).

6) AML/CFT и KYC

KYC/KYB: ID/age (usually 18 +), beneficiary identification, sanctions/PEP screening; proof of ownership of the payment means.
Source of funds (SoF): verification by triggers (large/suspicious deposits, prize cashing schemes).
Transactional monitoring: identification of anomalies, connectivity of accounts/devices/cards; STR/SAR commit and escalation in IMPA.
Retention and data protection: storage of KYC dossier/logs on time, secure data processing, access restriction.

7) Responsible Gaming (RG) and Consumer Protection

Age filters and verification of documents before admission to participation/payment of winnings.
Self-restrictions (deposit/time limits), "timeouts" and "cooling" in the online channels of permitted operators; prohibition of marketing to vulnerable and self-excluded persons (if their register/status is provided).
Clear risk communication and fair information on odds and conditions of draws/bets.

8) Advertising, promo and affiliates

Advertising is strictly limited: mandatory RG labeling, prohibition of targeting minors, lack of promises of "guaranteed winnings" and aggressive inductions.
Affiliates and media are responsible for promoting illegal sites; requires creative/channel whitelists and compliance log (screenshots/URL/dates/geo/target).
Violations entail prescriptions, fines, blocking of sites and payment routes.

9) IT loop for authorized operators and contractors

Certification of the platform, RNG/calculation modules, reporting showcases; version control and secure SDLC.
WORM logging along the chain "bet/ticket → calculation → payment → adjustment," time synchronization.
Supervision interfaces: secure APIs/uploads, test accounts, SLAs for responses.
Information security and stability: encryption at rest/in transit, RBAC/SoD, secret management, DR/BCP (target RPO/RTO), regular pentests/scans.

10) Enforcement and liability

Desk checks: reconciliation of reporting and payments, search for GGR/NGR anomalies (for authorized products), marketing/affiliate audits.
Cyber ​ ​ events: identification of back offices/hosting, domain chains/mirrors, pseudo-merchants and withdrawal routes.
Sanctions: fines, blocking domains/applications, suppression of payment channels, administrative and/or criminal liability for organizers; measures against the media/affiliates involved; for players - administrative consequences.
Mitigation: voluntary termination of violations, corrective plans, cooperation with authorities.

11) Roadmap: What Business Can Really Do

1. Role: content studio, platform, risk management, anti-fraud, payment/identification infrastructure, RG tools.
2. Compatibility: security/certification requirements, reporting formats, integrations (KYC/AML providers, IMPA processes).
3. Contract base: SLA, data protection, IP rights, escrow/code deposit, continuity plan.
4. Marketing: complete refusal to promote illegal immigrants to the audience of Israel; white list of creatives/channels, compliance magazine.
5. UAT/pilot: test cases of calculations, limits, RG/AML scenarios, resistance to block events (within the legal perimeter).

12) Compliance checklists

Legal regime

• Confirmed: Mifal HaPais and/or Toto/Winner only (via contracts/tickets)
• Responsible for AML/RG/IS appointed; trained and certified
• Procedures for responding to lock/payment orders

Tax & Reporting

• Separate accounting by products/channels; transparent accounting of bonuses/void/cashout
• Declaration/payment calendar; otchetnost↔billing reconciliation <0.5%
• Annual audit; storage of primary and logs

AML/KYC & RG

• KYC/KYB policies, sanctions/PEP, SoF triggers; STR/SAR log
• Deposit/time limits; Timeouts/cooling filters for vulnerable groups
• Mechanism to prohibit marketing to self-excluded

IT and Security

• Platform Certificates/RNG; WORM logs; time synchronization
• Encryption, RBAC/SoD, secret management, penetration tests/scans
• DR/BCP Tests and Recovery Plan

Marketing & Affiliates

• Only permitted brands; RG-marking; without "dark patterns"
• Compliance log (screenshots/URL/dates/geo); Quick Recall
• Tough ban on promo illegal sites/mirrors

13) First year KPI

Fiscal: timely filing ≥99%; discrepancy otchetnost↔billing <0.5%.
AML/KYC: average verification time; share of false positives; SLA STR/SAR.
RG: proportion of participants with active limits; Self-exclusion lock TTR <1 min.
Information security/reliability: MTTR incidents; execution of DR tests; closing critical vulnerabilities.
Marketing: 0 cases of unlicensed brand promos; 100% compliance with guidelines.

14) FAQ

Is it possible to open a private online casino or poker room?
No, it isn't. Private B2C activities in casino/slots/poker are prohibited. Only state exceptions (lottery and sports bets) are allowed.

Is there a legal path for a private company?
Yes, in the format of a B2B contractor for state operators: technology platform, content, risk/AML, anti-fraud, payments, RG tools - subject to strict compliance with the requirements.

How is block bypass evaluated?
As an aggravating circumstance: mirrors, proxy chains, "pseudo-merchants" strengthen sanctions and risks of administrative/criminal liability.

What are the key risks for affiliates?
Blocking domains/accounts, fines, suppression of payment flows, possible proceedings for the promotion of illegal immigrants.

Note

Israel regularly updates law enforcement practices (block measures, requirements for advertising and payment routes). For legally significant decisions, check the current texts of laws/by-laws and public rules of state operators.