Malta Regulator Names Six Sites Faking an MGA Licence, Including a Casino Claiming Juventus Ties

The Malta Gaming Authority published a notice on 25 June 2026 naming six websites that reference the regulator in what it called a "false and misleading" manner, including an operator that pairs the MGA name with the crests of two of European football's biggest clubs. None of the six holds an MGA licence. The action is the latest in a string of public warnings the authority has issued against sites that borrow its name to look legitimate, a problem the MGA traces back to its first such notice in 2006.

The headline case is OP7, which ran across two of the flagged URLs and stitched together a wall of borrowed credibility. Its sites carried the MGA moniker alongside Curacao Gaming, the European Gaming and Betting Association and the crests of Juventus and Benfica, neither of which mentions OP7 anywhere on its own site. OP7 Sports did post an Instagram video that appears to show Juventus players wishing fans a Happy Chinese New Year. The operator also claimed an "offshore licence NO 16-0025" without naming a jurisdiction, and online gambling is expressly prohibited in mainland China, where the government has warned that gambling "leads to a path of no return, including financial ruin, family breakdown, and even death."

The other four URLs follow the same pattern of name-dropping a regulator that never licensed them. Ufabet.black markets itself as a Thai football betting site and states that "the internationally recognised Malta Gaming Authority oversees UFABET through its licensing," with no licence code attached. Playtok.bet, a Philippine site that lifts design elements from TikTok, displays both the Curacao and MGA logos but shows no PAGCOR licence, which Philippine operation requires. The most revealing entry is www.vulkanworld.com, whose licence link claims registration under Genesis Global Limited and the code MGA/B2C/314/2015. That code returns nothing in the MGA registry. Genesis Global was previously registered under MGA/CRP/314/2015, and that licence was cancelled in 2024. The same 314/2015 code was earlier cited by Vavada Ltd, which drew a similar MGA warning in February 2025.

Why a Malta licence is worth faking

The MGA seal is valuable to fraudsters precisely because the real thing carries weight. Malta's gaming sector generated 1.386 billion euros (about $1.5 billion) in gross value added in 2024, around 6.7% of the national economy and roughly 10.1% once indirect spillover is counted, per the MGA's 2024 annual report. The jurisdiction counted 315 active licensees holding 323 licences, employed about 14,357 people, and collected 82.4 million euros (about $89 million) in fees, levies and consumption tax. A consumer who sees "MGA licensed" reasonably assumes segregated player funds, dispute resolution and anti-money-laundering controls. A cloned site offers none of that, which is the gap the authority keeps pointing at. In each notice the MGA repeats that "the activities of unlicensed entities are unregulated and do not provide the necessary safeguards delineated by virtue of the framework, making transactions with such entities risky for consumers."

The reuse of a dead licence code is the detail B2B suppliers and affiliates should sit with. A cancelled credential does not disappear from the open web when the MGA pulls it; it gets recycled. That a 2015 Genesis Global code resurfaced on a Ukrainian-language Vulkan World page, after already being abused by Vavada, shows how a single revoked licence number can circulate across unrelated scam brands for years. The dual-badge tactic of stacking an MGA logo next to a Curacao licence is designed to survive a quick glance. It overlaps with the SEO playbook seen in cases where fraudsters hijack expired domains to inherit trusted search authority.

What enforcement actually moves

A naming notice is a warning, not a takedown, and that is the limit worth being honest about. The MGA can disown a site and alert consumers; it cannot delist a .vip domain registered offshore or compel a foreign registrar to act. The pace tells the story: the authority flagged dragonia-casino.at and dragonia-de.de last month and issued comparable lists in January and February, a roughly monthly cadence of new clones.

For scale, the UK precedent shows what sustained disruption looks like when a regulator leans on intermediaries rather than issuing standalone alerts.

The UKGC numbers come from its disruption reporting and a confirmation that Google deleted 64,000 illegal betting sites in 2024. The contrast is the point: consumer warnings put the burden on the player to verify, while URL referrals and registrar pressure put it on the platforms that distribute the traffic. The MGA's registry remains the verification tool it tells consumers to use, but a fake site that copies a real licence code is built to defeat a casual check.

The affiliate angle is direct. Any partner running paid or organic traffic into casino and sportsbook offers inherits the brand-safety risk when a fake MGA badge sits on a landing page, and a cancelled-code clone like Vulkan World is exactly the kind of placement that turns into a chargeback dispute or a regulatory complaint later. The same dynamic drives the wider pressure on search and social platforms to police black-market gambling ads, since distribution is where these sites get their reach. For now the MGA has six more URLs on its list and a registry that says none of them are licensed in Malta.