Ukraine has put in place an automated system that prevents service members from using gambling sites during martial law while deliberately keeping their identities hidden from operators — the practical signal sent to casinos is simply “allow” or “block.”
How the blocking mechanism actually works
The system is managed by the state agency PlayCity and verifies player status in real time against two government sources: a military personnel register and a restricted-persons list via the Trembita data exchange platform. When a player attempts to log in, PlayCity’s check runs and the gambling operator receives only a binary response — a block or a pass — with no accompanying personal details or reason codes.
This architecture was implemented on the legal backbone of Law No. 9256-d, signed in January 2025, which also digitized licensing and tightened payment and advertising rules for the sector. PlayCity assumed supervision after the Commission for the Regulation of Gambling and Lotteries was dissolved; it is additionally authorized to coordinate removals of illegal apps and sites, working with platforms such as Apple and Google to enforce takedowns.
Why privacy and security shaped the design
Officials deliberately limited what operators receive to avoid creating a database of military identities at commercial platforms — a design choice intended to reduce the risk of data leaks or misuse. The immediate trigger for the restriction was a security concern: authorities detained the director of a major online casino in 2025 over alleged Russian ownership and possible data misuse involving Ukrainian service members, a practical example of why regulators prioritized non-disclosure.
That privacy-first approach means the system protects soldiers both from exposure and from targeted recruitment or harassment via gambling channels. At the same time, it constrains operators to respond to a simple compliance signal rather than to investigate identity details themselves, which shifts enforcement burdens onto state infrastructure rather than private firms.
What this is not — common misreads and real limits
This is not a blanket, permanent ban on all citizens or a public registry published to operators; it is a wartime, technical control that blocks access for accounts matched to the military registry during martial law without revealing military status. The rule set comes from executive and statutory steps taken since 2024 — including a presidential decree that first targeted service members — and was formalized in the 2025 legislation, but it’s limited to the channels PlayCity and Trembita can reach.
Practical gaps remain: the system’s current scope and enforcement are contingent on integration with platforms and financial controls. Regulators have signaled next checkpoints will include expanding checks across multiple accounts, tighter technical measures against illegal operators, and ongoing work to close loopholes that allow blocked users to reach services via unregulated apps or offshore platforms.
What industry actors and service members should do next
Operators: treat the block signal as final and maintain logs of anonymous block events for compliance reporting, but do not attempt to reconstruct identities—doing so would defeat the privacy purpose and could violate the legal framework established under Law No. 9256-d. PlayCity expects licensed platforms to cooperate with takedown requests and to route payments through bank-account mechanisms now mandated by the law.
Service members and families: expect automatic blocking when an account is identified against the military registry; if you believe you were wrongly blocked, resolution requires contacting the relevant military or PlayCity administrative channel rather than the operator. Regulators have warned that repeated attempts to bypass blocks via offshore sites or illicit apps may trigger broader enforcement against those platforms.
| Aspect | What operators receive | What the registry/system holds |
|---|---|---|
| Signal content | Block / Allow only (no personal data) | Full matchable identifiers and restriction flags (kept within state systems) |
| Reason visibility | No explanation provided | Stored reason codes and source lists (military registry, restricted list) |
| Operator action required | Deny access and log event; comply with takedown and payment rules | Maintain and update lists; pursue illegal operator takedowns |
Q&A — quick practical checks
When did this start? The legal framework crystallized with Law No. 9256-d in January 2025; the blocking mechanism builds on earlier 2024 restrictions and the wartime presidential decree.
Can an operator appeal a block? No — operators get no identity details to contest; appeals must go through PlayCity or the registry custodians if a technical error is suspected.
What signals would mean expansion is coming? Look for registry integration notices, announcements about multi-account detection, or new enforcement actions against offshore/illegal apps — regulators have listed those as near-term checkpoints.
