iGaming payments in Poland

The Register of Prohibited Domains is not a court product. The Finance Minister, or a KAS organ he designates, lists a domain ex officio; no judge is involved. From the moment of entry, two clocks start. Telecom operators must remove the domain from their DNS resolvers within 48 hours and redirect visitors to a ministry warning page. Payment service providers must stop serving the site within 30 days. Both duties carry fines up to PLN 250,000, and both hang off the same entry, which is what makes the Polish design unusual: the blocklist and the payment blacklist are one document. It is published as an XML feed with per-second timestamps, and ISPs consume it directly in DNS response-policy tooling.

The gap in the design is where the money actually moves. Article 15g binds providers serving payment services 'on' registered domains, which reaches the acquirer of a listed site but not the rails offshore players prefer: crypto cashiers, international wallets, and the mirror domain registered faster than the ministry can list it. Warsaw's administrative court keeps upholding entries when operators sue, and the register keeps growing an order of magnitude faster than any other enforcement channel the state runs. What it could not do, until now, was see inside a payment.

BLIK is not a niche rail. Polski Standard Platnosci processed 2.9 billion transactions worth PLN 441.5 billion in 2025, for 20.7 million active users; it is the default way Poland pays online. From 1 September 2026, with the approval of the central bank's president, the scheme's rules change: at authorization, the merchant domain behind every online BLIK payment is checked via API against the finance ministry's register, and a match is refused. Because the check runs at scheme level, it reaches transactions acquired abroad, the exact route unlicensed operators used to keep BLIK working after Polish PSPs cut them off.

1. 1

   The player confirms a BLIK code

   Six digits from the banking app, the same flow as every Polish online purchase; nothing changes on the surface.

2. 2

   The scheme reads the file

   Before authorization completes, the domain behind the merchant is queried against the register's API. The blocklist that used to bind ISPs and acquirers now executes inside the payment switch.

3. 3

   A match dies at authorization

   The transaction is refused whether the acquirer sits in Warsaw or abroad. What Article 15g asked payment companies to do in 30 days, the scheme now does in milliseconds.

The record shows what triggers the rare case: bank records. The Supreme Court's February 2024 cassation that quashed a player's conviction started with transfers from a Maltese operator landing in a Polish account. The one mass action predates the register era entirely, when the customs service named 17,700 offshore bettors with a combined PLN 27 million of winnings in 2014. At licensed operators the player-side tax is simpler and real: winnings above PLN 2,280 on a single coupon are taxed 10% flat on the whole amount, withheld by the bookmaker at payout. That rate survived 2026 only by veto: parliament passed a rise to 15%, and the president killed it in December 2025. Nobody in government is working on decriminalizing players. The sanctions sit in the Fiscal Penal Code, which no pending bill touches, and the finance ministry's on-record position from January 2025 is that no legislative work on the Gambling Act is underway at all.

Poland taxes betting on turnover: 12% of every stake, before odds apply. Operationally the bookmaker multiplies the stake by 0.88 and prices the bet on what remains, so a hundred zloty wager puts 88 in play. At real betting margins that is a confiscatory base; STS's own chief executive put the effective burden above 50% of gross revenue, and it shows in the odds: licensed Polish books run overrounds around 8 to 12% against 3 to 6% at the offshore books one register entry away. The popular 'bez podatku' promotions are not a tax break, just the bookmaker eating the 12% as marketing.

Liberalization is not what is moving; expansion is. In December 2025 the State Assets Ministry confirmed Totalizator Sportowy may launch additional online casinos under new brands, an idea reported under the working title MojeVegas. The hottest legislative fight of the season, meanwhile, is a lootbox bill the monopolist openly lobbied against, warning MPs it would let sweepstakes-style casinos in through the side door. The sizing war underneath is perfectly symmetrical. The finance ministry, calculating on H2 Gambling Capital data, says the grey share of online gambling revenue fell from 79.7% in 2016 to 29.1% in 2024; the monopolist separately commissions grey-market reports from the same consultancy. The licensed bookmakers' association cites H2 Gambling Capital turnover-basis research putting the black market at 46% by value, around PLN 74 billion, and the Warsaw Enterprise Institute projects that licensing private casinos would cut the online-casino grey share from about 41% to 16%. Both camps lean on the same consultancy's data, each commissioning the cut that suits it. As everywhere in this series: whose number you cite is a position.

Nineteen online betting permits were in force at the end of 2024, carrying seventeen-odd live brands. STS leads with about 32% of 2024 turnover, then Betclic around 20%, Superbet around 18% and Fortuna around 13%. The ownership layer is moving: Entain agreed in June 2026 to sell 20% of its CEE venture to EMMA Capital, handing the Czech fund control of STS's parent, while Superbet carries Blackstone and HPS money from a EUR 1.3 billion 2025 financing. A licensed site must run on a .pl domain with its gaming data processed in the EU or EFTA, and its payments must flow exclusively through regulated categories of payment institutions, a statutory allowlist that mirrors the register's blacklist.

The cashier itself is bank-rail plumbing with a Polish accent. BLIK is everywhere and deposit-only; payouts ride bank transfer, at speed: STS built a KIR-backed fast rail that pays in about ten minutes regardless of banking hours, and Fortuna and Superbet average fifteen minutes to a bank account, Superbet's fast rail running over Przelewy24. SafeCharge, Nuvei's acquiring brand, sits inside Fortuna's card-deposit flow. PayPal exists here, unusually for this series: STS launched it first, deposits-only, in July 2020, with closed-loop payouts to the wallet arriving later through its fast rail, and Superbet lists it alongside Skrill and Neteller. Apple Pay is common; Google Pay allows licensed Polish gambling on the web only, a restriction written in Google's own developer documentation. The front door is looser than the folklore says: a temporary account may stake up to PLN 8,000 for 30 days before identity verification, but nothing leaves until a verified Polish bank account matches the player's name, down to a one-grosz test transfer. Anti-money-laundering checks attach at the EUR 2,000 equivalent, on stakes or on collecting winnings.

• BLIKdominant

  instant bank transfer

  Default Polish online payment (20.7M active users, 2.9bn transactions in 2025); code-based bank push, deposit-only at gambling cashiers with payouts riding bank transfer. From 1 September 2026 the scheme itself checks the merchant domain against the prohibited-domains register at authorization, killing the grey-market BLIK route through foreign acquirers.

• Przelewy24 (P24)major

  instant bank transfer

  Gateway across 100+ PL banks; main distribution channel for BLIK and the fast-payout rail at Superbet (~15 minutes). PayU and Tpay serve the licensed vertical too; PayU's policy bans only unlicensed gambling.

• Visa/Mastercard

  local cards

  Live at licensed books (SafeCharge, Nuvei's acquiring brand, sits inside Fortuna's card flow); Apple Pay common, Google Pay allows licensed Polish gambling on the web only per Google's own API docs. Payouts still land on a verified, name-matched Polish bank account.