Scaremongering doesn’t help anyone

Dr Gayle Kimberley (LL.M (EU law, Bruges), LL.D – Partner, GKF Legal

The recent press release issued by the Court of Justice of the European Union on 15^th January 2026 in Case C-77/24 (Wunner) has generated significant media attention and, in some instances, alarmist commentary—particularly in relation to the liability of directors of Maltese-licensed gaming operators and the future of Malta’s regulatory framework. This article seeks to cut through the noise by explaining what the ECJ’s preliminary ruling actually does (and does not) say, clarifying the limited legal effect of such rulings, and outlining why conclusions about automatic liability, jurisdiction, or the “end” of Malta as a gaming hub are legally unfounded.

First, ECJ preliminary rulings do not decide the dispute. Under Article 267 TFEU the Court of Justice of the European Union only interprets EU law and issues general principles to guide national courts who asked the ECJ a question to help them in deciding their national cases. The cases remain national and are decided nationally and apply nationally, subject to the Rome II Regulation and the Brussels I Recast Regulation.

It’s important to note that this ECJ preliminary ruling (not judgement) does not apply any EU law to the facts of the case before the national Court, nor does it determine liability, jurisdiction, or damages. The national court remains exclusively competent to assess the facts, determine whether national substantive law is infringed and ultimately decide whether liability actually arises.

This is expressly confirmed in the press release itself:

“The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision.”

So, it remains to see how the Austrian courts will decide as to:

• whether Austrian gambling law was infringed in substance and in fact,

• whether directors can be personally liable in this case,

• whether Rome II exceptions apply and hence whether it should go back to Malta,
• whether causation and fault are actually personally established.

The ECJ ruling does NOT “end” the case, nor does it mechanically impose Austrian law or liability.

Second, the ECJ’s conclusions are explicitly conditional. The Court states that Austrian law applies “as a general rule”, not automatically. This means it keeps open Article 4(3) Rome II.

More specifically Article 4(3) of the Rome II Regulation allows departure from the lex loci damni (in this case Austria) where:

“it is clear from all the circumstances of the case that the tort/delict is manifestly more closely connected with another country.”

It is therefore still open to argue that, in these specific cases, there is a manifestly closer connection to Malta and therefore this displaces Austrian law. The ECJ expressly restates this exception in the press release but it does not go on to expand on this (probably because it wasn’t asked to) but nonetheless the Court does throw it in there. So let’s consider this further.

1. Malta nexus:

• Operators are: – incorporated in Malta, – licensed and supervised in Malta, – operating under Maltese regulatory law
• Servers, payment infrastructure, compliance teams, AML/KYC processes are usually Malta-based.
• Terms & Conditions are typically governed by Maltese law and designate Malta as the place of establishment and operation.

This creates a systemic regulatory nexus with Malta that is not displaced merely by the player’s residence and hence Article 4(3) Rome II Regulation should apply.

2. Directors per se

For director liability, the connecting factors to mention are even stronger:

• Directors reside in Malta.
• All alleged acts or omissions (licensing reliance, compliance decisions) occurred in Malta.
• There is no operational decision-making in Austria.

This weighs heavily in favour of displacing Austrian law under Article 4(3) in favour of Maltese law.

3. Substantive law

Even if Austrian law were prima facie applicable, liability HAS NOT been established and is far from automatic.

(a) The ECJ did not rule that Austrian law creates liability

The Court only held that according to Rome II, the Austrian judge can apply Austrian law and that director liability is not excluded per se. It did NOT hold that:

• Austrian law does impose liability,
• the specific Austrian provisions apply extraterritorially,
• fault, causation, or unlawfulness are satisfied.

All of this remains for the Austrian courts.

(b) Maltese compliance is legally relevant

Directors can argue:

• They fully complied with Maltese law, including licensing and regulatory oversight.
• EU law does not impose full harmonisation of gambling regulation.
• Maltese Courts have held that these claims violate Maltese public policy and judgments seeking to enforce them are not enforceable in Malta.
• Reliance on a valid Maltese licence is reasonable, consistent with legal certainty and protected by legitimate expectations.

(c) Player conduct and VPN usage

The ECJ press release assumes participation “from Austria”, but this is a presumption, not a legal certainty.

One could still argue that Austrian players frequently use VPNs, conceal or manipulate their geo-location and actively bypass national restrictions.

This therefore may break the causal chain because it was not the operator to “target” Austria but rather it was the player who self-located into the service.

Then how does one prove causation, fault of director, place of damage, and last but not least jurisdictional fairness?

Conclusion

I wanted to put down some of my high-level thoughts because scaremongering does not help anyone and I wanted to lay out how I see the facts at play. There is a whole host of more detailed legal arguments to be made on behalf of Maltese directors which are not the scope of this article.

Malta’s law and regulatory framework is solid and reputable, as are its duly licensed operators. Other Member States do not protect consumers more and so they have not been able to rely on this defence to restrict the free movement of services of duly licensed Maltese operators successfully.

But if we were to focus on this ECJ press release, please note that the ECJ can NOT decide the case and therefore this is not a decision and this is not final because:

1. It is an interpretative ruling, not a judgment on liability.
2. It expressly allows exceptions under Rome II.
3. It leaves all factual assessments to Austrian courts.
4. It does not eliminate:

– Maltese law arguments,

– free movement of services,

– lack of fault,

– player misconduct,

– manifestly closer connection to Malta

The ECJ ruling does not determine liability, applicable law in fact, or the outcome of the proceedings. It merely clarifies the interpretation of Rome II, while expressly preserving the national court’s discretion, the “manifestly more closely connected” exception, and all substantive defences based on Maltese law compliance, free movement of services, and factual circumstances such as player conduct and VPN usage.

Liability under Austrian tort law still has to be decided. This means the Austrian Courts need to find personal fault and/or negligence in a director – a director who is residing in Malta, an EU Member State, who is acting in the best interest of his/her company as per his/her fiduciary duties and in full compliance with Maltese law and the EU Treaties.

Austrian Courts will also need to decide that a director is personally at fault despite the fact that the damage actually depends on player behaviour: use of VPNs, misrepresenting their location and actively circumvent national restrictions. Directors cannot control real-time physical location of users or the deliberate concealment by players.

I will leave the assessment of Austrian law to Austrian lawyers but I do believe it could be argued that there is also no jurisdiction of Austria here as the matter is manifestly more closely connected with Malta for the reasons set out above.

Finally, piercing the corporate veil is exceptional and courts should be wary of setting this precedent against fellow Member State establishments (not least bearing in mind the EU Treaty freedom of establishment). This is not a case of a sham structure!

In short, it is my opinion that Maltese law should apply on the basis of Article 4(3) Rome II and that the directors cannot be personally liable for tort because they acted lawfully under Maltese law, relied in good faith on a valid licence and EU free-movement principles, did not target Austria, lacked fault, and any alleged damage resulted from player-initiated conduct beyond their control.