Germany’s OASIS Register and LUGAS Limits: Operator Obligations Under GlüStV 2021

Every licensed online gambling operator in Germany carries two mandatory real-time compliance obligations that operate in parallel and are non-negotiable under the Glücksspielstaatsvertrag 2021 (GlüStV 2021): a query against the national self-exclusion register known as OASIS, and a query against the cross-operator deposit-limit file known as LUGAS. Both systems are administered by the Gemeinsame Glücksspielbehörde der Länder (GGL), the joint federal gambling authority established under §§ 27a ff. of GlüStV 2021 and operational since 1 January 2023. Failure to query either system at the prescribed moment, or accepting a deposit or permitting play after a negative return, constitutes an administrative offence under the treaty’s Ordnungswidrigkeiten provisions. This article sets out precisely when each query must occur, what operators must do with the result, and where liability attaches when the process breaks down.

Legislative Framework: GlüStV 2021 and the GGL

The Staatsvertrag zur Neuregulierung des Glücksspielwesens in Deutschland, signed 29 October 2020 and in force from 1 July 2021 across all 16 German Länder, replaced the GlüStV 2012 and opened online casino and virtual slot gaming for the first time at a federal level. The treaty establishes the GGL as the central licensing and supervision authority for cross-state online gambling verticals, including online casino games, virtual slot machines, online poker, and online sports betting. State-level authorities retain competence for lotteries, betting offices, and land-based venues.

The responsible gambling architecture of GlüStV 2021 rests on three interlocking systems: mandatory player accounts (§6a), the cross-operator deposit-limit file LUGAS (§6c), and the national self-exclusion register OASIS (§§ 8, 8a, 8b). All three are charged services for obligated providers under §8c. Operators licensed by the GGL must connect to each system and query it at the intervals the treaty prescribes. There is no opt-out and no grandfather provision for operators already connected to legacy state-level exclusion files, §8d required those databases to migrate into the national system.

OASIS: The National Self-Exclusion Register

OASIS (Overgreifendes Spielersperrsystem, or cross-cutting player exclusion system) is the centralised, nationally uniform database of excluded gamblers maintained under the authority designated in GlüStV 2021 §23. Unlike the operator-level exclusion tools common in Malta Gaming Authority and Curaçao-licensed regimes, OASIS functions as a statutory cross-operator register: a player who is entered into OASIS is barred from every online gambling product covered by GlüStV 2021, across every licensed operator simultaneously.

The GlüStV 2021 §8 Abs. 3 states the obligation directly: Veranstalter und Vermittler von Glücksspielen, an denen gesperrte Spieler nicht teilnehmen dürfen, sind verpflichtet, organisers and intermediaries of gambling in which excluded players are prohibited from participating are obliged to identify persons wishing to play and to perform a check against the Sperrdatei. For online gambling, the identification must use a technically suitable procedure, and the check must occur at the moment specified in §6h Abs. 3 Satz 1, which corresponds to the point at which the operator transmits data before permitting the player to access gambling products. Practically, this means the OASIS query must complete at every qualifying login or session-start event, not merely at account registration.

“Veranstalter und Vermittler von Glücksspielen haben sicherzustellen, dass gesperrte Spieler nicht an Glücksspielen teilnehmen.”, GlüStV 2021 §8 Abs. 3 Satz 3.

The requirement to ensure excluded players do not participate is absolute. Operators cannot satisfy this obligation by maintaining their own internal exclusion list alone. The §8 query is separate from and additional to any operator-level exclusion system the licensee maintains.

Who Can Be Entered into OASIS, and for How Long?

GlüStV 2021 §8a distinguishes two categories of exclusion entry. A Selbstsperre is a self-initiated exclusion where the player requests to be added to OASIS. A Fremdsperre is an exclusion imposed by an obligated provider, typically when a licensee identifies a player showing signs of gambling disorder and considers continued participation to be incompatible with the player protection objectives of §1 GlüStV 2021.

Under §8a Abs. 6, the minimum exclusion period is three months. Where a person applying for a self-exclusion requests a period shorter than three months, the system treats that request as a three-month exclusion. The default period, absent a specific request, is one year. The obligated provider entering the exclusion must immediately notify the affected person in writing that an entry has been made, and must inform them of the procedure for lifting the exclusion.

The obligated provider must retain exclusion applications for self-exclusions and supporting documentation for operator-initiated exclusions. Where an operator ceases trading, undergoes a merger, or becomes insolvent, all exclusion-related documentation must be transferred to the authority responsible for maintaining the Sperrdatei, with §8a Abs. 7 permitting that authority to assign the exclusion records to any legal successor.

Lifting an OASIS Exclusion: §8b

An exclusion entered into OASIS can only be lifted on written request from the excluded person. GlüStV 2021 §8b Abs. 1 makes this explicit: lifting is available only on written application by the barred individual. This rule applies even where the original exclusion application specified a defined duration. The operator cannot lift or expire an exclusion unilaterally, and no automatic reinstatement occurs at the expiry of the stated period without the excluded person initiating the §8b process.

In practice this means operators must build their account-reactivation workflows around the §8b condition. A player who was excluded for, say, six months and then attempts to log in after that period cannot be granted access until the competent authority has processed the written lifting application and confirmed the exclusion is removed in the Sperrdatei. Any account access before that confirmation exposes the operator to liability.

GDPR and Data Retention: The Six-Year Rule

The personal data of excluded players held in the Sperrdatei is subject to a statutory retention and deletion schedule. GlüStV 2021 §8 Abs. 5 requires that data be deleted six years after the end of the exclusion period. The data controller for GDPR purposes (Regulation (EU) 2016/679) is identified in §8 Abs. 6 as the entity that entered the data, meaning the licensed operator or intermediary that processed the original exclusion, not the GGL itself, carries the GDPR controller responsibility for the data it submitted. Where the authority transfers records to a legal successor under §8a Abs. 7, the successor becomes the GDPR controller.

The distinction matters operationally. A licensee that exits the German market cannot simply delete its OASIS data on exit: the records must be handed to the competent authority under §8a Abs. 7 Satz 2, and the authority may transfer them to a successor. Compliance teams planning market exits must account for this obligation explicitly in their wind-down procedures.

LUGAS: The Cross-Operator Deposit Limit File

Parallel to OASIS, GlüStV 2021 §6c establishes a second mandatory real-time infrastructure: the Limitdatei, commercially referred to as LUGAS (Limitübergreifendes Spielersicherungssystem). LUGAS tracks and enforces a cross-operator monthly deposit cap that applies to every player across the entirety of their licensed online gambling activity in Germany, regardless of how many operator accounts they hold.

The deposit ceiling under §6c Abs. 1 is €1,000 per month. Players may set a lower individual limit, they may not set a higher one. At registration, operators must prompt each player to either set a new individual monthly cross-operator deposit limit or to confirm that a previously established limit should remain unchanged. Where the player selects “retain existing limit” and no limit is stored in LUGAS for that player, the system returns this result to the operator, which must then prompt the player to set a limit before gaming access is granted. Play cannot commence without a limit being set.

“Das anbieterübergreifende Einzahlungslimit darf grundsätzlich 1 000 Euro im Monat nicht überschreiten.”, GlüStV 2021 §6c Abs. 1 Satz 2.

Limit changes are asymmetric. Under §6c Abs. 3, a player who wishes to reduce their limit has the reduction take effect immediately. A player who wishes to increase a limit must wait seven days before the increase becomes active, a statutory cooling-off window designed to protect impulsive uplift requests. The maximum permitted limit after any increase remains €1,000.

The Pre-Deposit Query Obligation Under §6c

The most operationally intensive obligation in §6c is the real-time pre-deposit query. Under §6c Abs. 6, before completing every deposit transaction the operator must transmit to the Limitdatei the data necessary to uniquely identify the player, together with the amount the player intends to deposit. That transmission is only permissible once the player has confirmed the intended amount. The Limitdatei then returns a response. If the limit is not exhausted, the deposit may proceed. If the limit is exhausted, the operator must decline the deposit and may not permit further gambling activity until the new monthly period begins.

The statute is explicit that permitting a deposit after the LUGAS limit is exhausted is an administrative offence. GlüStV 2021’s Ordnungswidrigkeiten section lists as a violation: “entgegen §6c Absatz 1 Satz 8 eine Einzahlung ermöglicht, wenn das anbieterübergreifende Einzahlungslimit erschöpft ist”, enabling a deposit when the cross-operator deposit limit is exhausted. The offence attaches to the operator, not the player.

System	Legal Basis	What It Tracks	Query Trigger	Effect of Adverse Return
OASIS (Sperrdatei)	GlüStV 2021 §§ 8, 8a, 8b	Excluded players (self- and operator-imposed)	Every qualifying login/session-start (§8 Abs. 3 Satz 4 + §6h Abs. 3)	Operator must refuse gaming access immediately
LUGAS (Limitdatei)	GlüStV 2021 §6c	Cross-operator monthly deposit spend	Before every deposit transaction (§6c Abs. 6)	Operator must decline deposit, no further gambling until next month

Operator Liability: The Ordnungswidrigkeiten Framework

GlüStV 2021 contains a dedicated schedule of administrative offences applicable to licensed operators. The relevant provisions make clear that liability is conduct-based, not intent-based: whether or not the operator was aware that a player was excluded or had exhausted their LUGAS limit, the act of permitting play or accepting a deposit in those circumstances is itself the offence.

The violations most directly relevant to OASIS and LUGAS compliance are:

Permitting participation without the cross-operator deposit limit being set (§6c Abs. 1 Satz 6 violation); enabling a deposit when the cross-operator limit is exhausted (§6c Abs. 1 Satz 8 violation); failing to transmit the required data to the Limitdatei at the prescribed time (§6c Abs. 5 and 6 violations); and permitting further play after a parallel-play session limit has been exceeded (§6h Abs. 1 and 3 violations).

Beyond these specific LUGAS-related offences, §8 Abs. 4 addresses the obligation to take necessary protective measures where a player identified as at risk continues to gamble despite advice to seek counselling. The GGL has supervisory powers to investigate compliance with all of these provisions, and the GGL’s enforcement register documents actions taken against licensed operators.

What Does OASIS Query Look Like in Practice?

GlüStV 2021 §8 Abs. 3 Satz 2 requires that online identification occur before the exclusion check, using technically suitable procedures (geeignete technische Verfahren). The GGL has not published a single mandatory technical specification equivalent to Sweden’s SIFS 2026:3 for Spelpaus, but operators are expected to authenticate the player’s identity and then query OASIS in real time at the session-trigger moment. The identity data transmitted to OASIS must be sufficient to enable a unique match against the Sperrdatei.

By comparison, Sweden’s Spelinspektionen formalised Spelpaus API requirements in SIFS 2026:3 (decided 23 April 2026, in force 1 August 2026) with specific API endpoint designations and credential rules. The German framework leaves more technical discretion to the operator, but the legal obligation is structurally similar: a mandatory pre-session query against a centralised national register, with immediate access refusal on a positive match.

Operators integrating OASIS for the first time should work with the GGL to obtain API credentials and to test integration against the GGL’s test environment before going live. The cost of connection is borne by the operator under §8c, and access fees apply to all queries, including unsuccessful queries where no exclusion is found.

OASIS in European Context: Cross-Register Comparisons

The architecture of OASIS places Germany within the national self-exclusion register model, alongside Spain’s RGIAJ, France’s Interdiction Volontaire, Denmark’s ROFUS, and Sweden’s Spelpaus. Each of these systems operates as a centrally maintained database that binds all licensed operators within the jurisdiction, rather than relying on operator-level exclusion lists maintained separately per brand.

Register	Jurisdiction	Regulator	Min. Exclusion Period	Covers Sports Betting	Covers Online Casino
OASIS	Germany	GGL	3 months (default: 1 year)	Yes	Yes
GAMSTOP	United Kingdom	UKGC (mandated)	6 months	Yes	Yes
Spelpaus	Sweden	Spelinspektionen	1 month	Yes	Yes
ROFUS	Denmark	Spillemyndigheden	No fixed minimum	Yes	Yes
RGIAJ	Spain	DGOJ	No fixed minimum	Yes	Yes
Interdiction Volontaire	France	ANJ	3 years (self-exclusion)	Yes	N/A (no online casino licensed)

The LUGAS deposit-limit infrastructure has no direct analogue in the UKGC or MGA frameworks, where deposit limits are operator-set and verified operator-side. The closest model is Belgium’s cross-operator weekly deposit cap enforced via a central gaming account (spelersaccount), though the Belgian system uses a different technical architecture. Operators already compliant with GAMSTOP integration should not assume that familiarity with that system provides a sufficient technical baseline for OASIS or LUGAS, which each carry separate query-trigger rules and data-transmission obligations distinct from the UKGC framework. For a comparison of how the UKGC and MGA approach player-protection obligations more broadly, see our analysis of UKGC vs MGA licence requirements in 2026.

The GlüStV 2021 Review and Future Reform

GlüStV 2021 requires a comprehensive evaluation report by 31 December 2026, assessing whether the treaty’s objectives, particularly channelisation and player protection, have been achieved. Industry commentary, including reporting by iGamingBusiness in 2026, suggests the licensed market has struggled: the €1,000 monthly deposit cap enforced via LUGAS, combined with the €1 maximum stake on virtual slots and a 5.3% stake tax, has weakened channelisation rates and pushed a significant portion of German players toward unlicensed offshore operators. The German Sports Betting Association (DSWV) has publicly argued that strict rules are not fully achieving their stated objectives when players simply migrate to the unregulated market.

The review may result in targeted adjustments, higher slot stake limits or a revised tax model are the most discussed changes, but significant relaxation of OASIS or LUGAS is not on the current reform agenda. Both systems represent core player protection infrastructure that the treaty’s §1 objectives expressly mandate. Compliance officers should plan for OASIS and LUGAS to remain in their current form through at least the next treaty cycle, and should treat any reform as an upward adjustment to limits rather than a fundamental architectural change. Treaty reform, if any, also does not remove existing operator liability for historical failures to query correctly.

The responsible gambling observatory maintained on this site tracks self-exclusion regimes and deposit-limit architectures across all 17 regulated jurisdictions covered by iGamingCompliance.io, including a live comparison of national register models versus operator-level exclusion approaches.

Compliance Checklist: Minimum Operational Requirements

Licensed operators in Germany must maintain the following as a baseline. The OASIS connection must be live and queried at every qualifying session-start event. The LUGAS connection must be queried before every deposit transaction, with a fail-closed default if no response is received. Internal exclusion systems must not substitute for OASIS: both must operate in parallel. Players must be prompted to set or confirm a LUGAS limit at every new account registration. Limit reductions must take effect immediately, limit increases must be held for seven days. Self-exclusions may only be lifted on written application by the excluded person via the §8b procedure. Exclusion documentation must be retained and transferred on business cessation. GDPR controller responsibility for OASIS data rests with the operator that submitted the exclusion, for the six-year post-exclusion period.

In practice, operators should conduct periodic end-to-end testing of both OASIS and LUGAS query flows to verify that the correct API responses produce the correct downstream account actions. The administrative offences attach to the output of the flow, not to the intention behind it. Documentation of testing, including timestamps and API response logs, is the evidential baseline for demonstrating compliance to the GGL in any supervisory inquiry. Operators should seek qualified legal counsel for jurisdiction-specific application of these requirements, particularly in relation to the GDPR controller obligations and the Fremdsperre discretion.

Key Resources

GlüStV 2021, Staatsvertrag zur Neuregulierung des Glücksspielwesens in Deutschland (signed 29 October 2020, in force 1 July 2021). Full text via Bayern.Recht: https://www.gesetze-bayern.de/Content/Document/StVGlueStV2021. The primary source for all OASIS (§§ 8, 8a, 8b, 8c, 8d) and LUGAS (§6c) obligations.

GGL, Gemeinsame Glücksspielbehörde der Länder. Official regulatory authority website, including the GGL enforcement register and operator guidance: https://www.gluecksspielbehoerde.de

ICLG Gambling Laws and Regulations Germany 2026. Annual practitioner guide covering the current licensing framework, responsible gambling obligations, and enforcement environment: https://iclg.com/practice-areas/gambling-laws-and-regulations/germany