Switzerland - ESBK/Comlot

(Section: "Markets and Jurisdictions")

1) Market picture and regulators

• ESBK (Eidgenössische Spielbankenkommission/Swiss Federal Gaming Board) is the federal regulator of casinos (terrestrial and their online verticals).
• Comlot → Gespa is an intercantonal body for lotteries and mutual bets/bets (Comlot has been transformed since 2021 and acts as Gespa).
• The legal basis is a modern "monetary gaming" framework that allows online casinos only through Swiss licensed casinos, and provides for the blocking of illegal domains.

2) Distribution of roles and products

ESBK: licensing and supervision of casino operators (categories of establishments, tables/slots, jackpots), as well as their online casinos (permits to the Internet channel are issued to existing casinos when fulfilling those/RG/AML requirements).
Gespa (ex-Comlot): oversight of lotteries/instant lotteries and inter-cantonal betting/betting; activities are carried out by state operators (Swisslos, Loterie Romande) and their partner network.
Anti-" gray "contour: centralized block lists of domains of unlicensed online games/bets, binding communication providers.

3) Admission model and online

Land casino: federal license (category, address, list of games, technical infrastructure, security, internal control).
Online casinos: only existing Swiss casinos are allowed, which receive a separate admission to the Internet channel, ensure the placement of critical functions/data in accordance with the requirements, provide the regulator with access to reporting showcases and logs.
Lotteries/bets: under inter-cantonal admission; online products - in the perimeter of Gespa and state operators.

4) Taxes, fees and distributions (high level)

Casino sector (ESBK): a special game fee with GGR on a progressive scale (for terrestrial and online channels of the same casino license). Part of the proceeds is sent to the federal budget/social funds in accordance with the law; the upper rate is limited by law (progression from the "low" GGR threshold to the "upper" bar).
Lotteries/rates (Gespa): There are targeted deductions "for public purposes" (sports, culture, social programs) under inter-cantonal distribution rules.
CIT and VAT: corporate tax - at general Swiss and cantonal rates; bets/winnings are usually outside the scope of VAT, and related services (IT, marketing, hosting) - according to general rules.
Reporting and payments: monthly/quarterly forms by product type and channel; annual audit of the financial statements.

5) AML/KYC and identification

Responsibilities: risk-oriented KYC/KYB, verification of age (18 +), sanctions/PEP, source of funds for triggers; accounting of transactions and "connectivity" of payment instruments.
Casinos as subjects of AML/CFT: formalized internal controls, appointment of responsible persons, personnel training, recording and escalation of suspicious transactions.
Data storage: retention of KYC dossiers/journals and protection of personal data according to Swiss/EU standards (GDPR compatibility).

6) Responsible Gaming (RG)

Self-exclusion/entry bans (Sperren): a single entry/admission prohibition mechanism that applies to all licensed offline casinos and their online channels; operators are obliged to check the status at the entrance/registration and before payments.

Self-limiting: deposit/loss/time limits, "timeouts" and "cooling."

Early risk diagnosis: loss pursuit patterns, frequent deposits, nocturnal activity - the basis for the intervention of the RG team and/or the introduction of restrictions.

Communications: visible warnings, "honest probability," help contacts; prohibition of "guaranteed winnings."

7) Advertising, promo and affiliates

Advertising: moderation and targeted responsibility; prohibition of targeting minors/vulnerable; mandatory RG markings; limitations on aggressive inductions and "dark patterns."

Bonuses: transparent T&C (wagers, deadlines, mouthguards), correct accounting in GGR/NGR.
Affiliates: permissible for licensed brands with tight control of creatives and placements; promotion of unlicensed sites - the basis for prescriptions and sanctions.
Suppression of gray traffic: domain block lists and coordination with the payment infrastructure.

8) Technical requirements and regulator access

Certification: RNG/game modules and platform - certificates of recognized laboratories; periodic recertification.
Logging: immutable logs (WORM) along the full chain "rate → calculation → payment → adjustment," time synchronization.
ESBK/Gespa access: secure uploads/APIs, test accounts, prompt responses to requests; compatibility of reporting formats.
Reliability and information security: redundancy, DR/BCP (target RPO/RTO), encryption at rest/in transit, RBAC/SoD, regular penetration tests/scans.

9) Inspections and enforcement

Office: reconciliation of reporting and payment discipline, verification of GGR/NGR anomalies, monitoring of bonuses/returns/void/cashout.
Field/IT audit: sampling of sessions/transactions, inspection of cash/server logs, staff interviews, "secret buyers," audit of RG/AML procedures.
Sanctions: fines, additional charges, UX/RG regulations, blocking domains and channels, suspension/revocation of admission to an online channel.
Mitigation: voluntary disclosure of errors, corrective plans, strengthening of internal controls.

10) Entry roadmap (operator & provider playbook)

1. Strategy: to determine the role - a ground casino with an online channel (ESBK) or a technology/content provider for state lottery/betting operators (Gespa-perimeter).
2. Legal structure: local presence and financial stability; fit & proper for key individuals and beneficiaries.
3. Licensing/tolerances: document package, platform specification, RG/AML plans, reporting architecture, logging schemes.
4. IT loop: RNG/module certification, WORM logs, reporting showcases, API/uploads for regulators.
5. AML/KYC/RG: data providers (sanctions/PEP), SoF scenarios, limits/timeouts/self-exclusion, RG case log.
6. Marketing/affiliates: white list of creatives, self-excluded filter, frequency caps, quick recall procedure.
7. UAT and pilot: test cases of GGR/NGR calculations, exceeding limits, correctness of bonus accounting, escalation of STR/SAR.
8. Go-Live: freeze configurations, runbook incidents, SLA with PSP/hosting/providers, communications with ESBK/Gespa.
9. First 90 days: rhythm of declarations, otchetnost↔billing reconciliations (<0.5%), internal audit RG/AML/IS.

11) Compliance checklists

ESBK/Online Casino Channel

• Valid casino license and online channel access
• Platform/RNG Certification; WORM logs and time synchronization
• Reporting/payment calendar; discrepancy control <0.5%
• RG/AML procedures, responsible persons assigned

Gespa/Lotteries & Betting

• Inter-cantonal tolerances; contracts with state operators
• Deductions "for public purposes" under distribution rules
• Marketing/affiliate logs, filters for vulnerable audiences
• Compatibility of reporting formats and SLAs for Gespa requests

Information security and reliability

• DR/BCP with target RPO/RTO; reservation
• Encryption at rest/in transit; RBAC/SoD
• Regular pentests/scans; managing secrets

12) KPI for operational control

Fiscal: timeliness of declarations ≥99%; discrepancy otchetnost↔billing <0.5%.
AML/KYC: average verification time; share of false positives; SLA STR/SAR.
RG: proportion of players with active limits; Self-exclusion TTR <1 min; the dynamics of complaints.
IS/Reliability: MTTR incidents; execution of DR tests according to the schedule; closing critical vulnerabilities on time.
Marketing: 100% self-excluded filtering; 0 violations by advertisement/induction.

13) FAQ

Is Comlot still in effect?
The organ is transformed and operates as Gespa; inter-cantonal surveillance functions are retained and expanded.

Is it possible to launch an online casino without a land-based casino license?
No, it isn't. Online casinos in Switzerland are only allowed as a channel of an operating Swiss casino under ESBK supervision.

Are there block lists of illegal domains?
Yes I did. Unlicensed online games/bets are subject to blocking at the communication provider level; advertising/payment ecosystem is obliged to cooperate.

How are bonuses taken into account in the tax base?
According to local rules for reflecting bonuses and adjustments in GGR/NGR; errors lead to additional charges and prescriptions.

Note

Specific casino collection progression rates, lottery/betting accounting methodologies, technical reporting formats and advertising restrictions are periodically updated. Before submitting an application and the first reporting period, be sure to check the current ESBK/Gespa texts and applicable instructions to avoid additional charges, prescriptions and pauses in operations.