EU Names Nine Game Companies in Coordinated Action: The Regulatory Ruler for Virtual Currency, Loot Boxes and Monetization Design#

By Wubian (NTGame Editorial · Online Game Economy Column)

Hello everyone, Wubian here. Years of writing about online game economies built a professional reflex in me: when I see the words virtual currency, my first thought is not a recharge button but an exchange-rate table — real money goes in, virtual currency comes out, and in between sit several layers of conversion, several bundles and an unknown quantity of bonus percentages. On September 29, the EU’s Consumer Protection Cooperation Network (CPC Network) launched a coordinated enforcement action against game companies, and on September 30 the CPC and the European Commission issued a joint statement naming Crytek, King, Mojang, Riot Games, Supercell, Ubisoft EMEA and others — nine game companies by the common media framing, ten legal entities in total — covering nine games including Valorant, Clash of Clans, Candy Crush Saga, Minecraft and For Honor. Every title on that list is a fluent operator of free-to-play monetization; and the regulatory spearheads this time point almost entirely at the thing I take apart daily: in-game virtual currency and payment design.

In this piece I will layer the story: who is on the list, what the seven core principles actually measure, how multi-layer virtual currency masks real costs, why loot boxes and dark patterns got named specifically, what divides the industry’s response, and how far the ruler could reach once the Digital Fairness Act draft lands in November.

1. The full picture: nine companies, nine games, a ruler suspended for eighteen months#

The timeline first. This was not a surprise attack but the closing move of a courtesy-first process:

The key is the middle stretch: after the consultations, checks found that a large number of game companies had made no substantive adjustments per the published guidance. In other words, regulators gave roughly eighteen months of dialogue, judged the response insufficient to justify more waiting, and moved to naming names.

Now the list. Ten legal entities were named (media shorthand: nine companies):

• Activision Blizzard UK Limited
• Crytek GmbH
• InnoGames GmbH
• King.com Limited
• Mojang AB
• Plarium Europe S.à r.l.
• PLR Worldwide Sales Limited
• Riot Games Limited
• Supercell Oy
• Ubisoft EMEA SAS

The gap between nine companies and ten legal entities has no official breakdown (one account suggests Activision Blizzard accounts for two of them); no official list exists, and we flag that as-is. Nine games were selected for further evaluation through market checks:

One caveat: the one-to-one mapping between nine games and ten legal entities has not been officially confirmed item by item. The link between Gardenscapes maker Playrix and PLR Worldwide Sales Limited on the list is reasonable media inference, not official confirmation, and we will not force the pairing in this text. The list’s spread is worth savoring: Candy Crush Saga and Gardenscapes are textbook casual monetization heavyweights; Minecraft stands on a content ecosystem rather than a paywall; and Valorant is a fairness-first competitive shooter whose monetization concentrates in skins — the checks clearly target not whoever is greediest but the common practices of in-game payment systems across the board.

Legally, the cross-border action proceeds under Regulation (EU) 2017/2394, coordinated by the European Commission with national consumer protection authorities. EU Commissioner for Consumer Protection Michael McGrath (full portfolio: Democracy, Justice, the Rule of Law and Consumer Protection) was direct in the statement: Around half of Europeans play video games… responsibility comes with that. The industry must ensure its games do not expose players — and especially children — to harmful or unfair practices. Games must be fair, and the rules must be respected. National authorities, supported by the Commission, will make sure they are enforced.

2. The seven core principles: what exactly does the ruler measure#

Understanding the action means going back to the March 2025 Core Principles for In-Game Virtual Currencies: seven items that draw the industry’s compliance baseline and form the yardstick of this action:

Read one by one, the seven land with precision on standard F2P practice. Match the most common monetization moves to the principles and the correspondence is immediate:

Principles 1 and 2 together strike at the deepest criticism of virtual currency: making it impossible for players to see, at the moment of payment, how much they are really spending. Principle 3 targets progression-blocking design — when free players hit a stat wall and the only smooth way through is buying more currency, that becomes an actionable point. Principle 5’s 14-day withdrawal right deserves special attention because it explicitly pulls unused virtual currency into the withdrawable scope, striking at the root of the industry norm that virtual currency is non-refundable once sold. Principle 7 lists child protection separately, echoing the loot box and dark pattern priorities that follow.

Commentators often reach for one example The Journal used to explain the regulatory logic: an in-game item can be bought outright for 4 euros, or paid for with a 5.99 euro currency pack — and the pack denominations do not line up with the item price, so a little change always remains in the account. Why that example matters unfolds in the next section.

3. How multi-layer virtual currency hides real costs: a mechanism breakdown from the economy side#

As someone who has long taken apart online payment structures, I want to make multi-layer currency masking concrete. A typical F2P dual-currency system usually has three layers between your wallet and the item:

Layer one: the top-up layer. Real money converts into hard currency (gems, crystals, points — the name does not matter), and this layer is almost never one-to-one. Top-up tiers are carefully designed, with bigger tiers carrying richer bonus ratios to push you into the large pack. What the purchase page shows is how many gems 648 yuan buys, not what each item actually costs.

Layer two: the packaging layer. Bundles, double-first-top-up, monthly cards and passes hide unit prices inside combinations. The same item can vary several-fold in effective price across bundles, but what the player sees at the moment of purchase is a value combo, not a price comparison table.

Layer three: the spending layer. Items are priced in virtual currency, deliberately misaligned with top-up tiers. That is the value of The Journal’s example: between a 4 euro direct price and a 5.99 euro pack sits a denomination gap, so after buying the pack and paying the item price, a small balance necessarily remains. It cannot be refunded or cashed out; its only function is to make the next top-up more likely. In economy-design terms it is a sunk cost; in regulatory terms it is precisely the entity Principle 2 calls masking actual spending through layered conversion.

The elegance (or cunning) of this layer: every step in isolation is legal — top-ups are voluntary, bundles carry price tags, items have prices. But stacked three deep, what the player loses at the moment of payment is the ability to judge whether they are paying 4 euros or 5.99 euros for this item. The CPC’s regulatory logic is to dismantle the stacking and pull real-money cost back to the first screen of the purchase decision. Principle 5’s 14-day withdrawal right is the second line of attack on residual balances: if unused virtual currency can be withdrawn too, the lock-in effect of leftover change largely collapses.

By the way, Principle 3’s bite against progression-blocking design may be bigger than assumed. Build a stat wall, then sell keys, is one of the most reliable revenue structures in live-service games; once forcing players to buy excessive virtual currency to progress is ruled an unfair commercial practice, what is affected is not just price display but the legal foundation of the entire paywall.

Following the regulatory logic through, a compliant retrofit has to touch at least these: show real-money prices directly on purchase pages so players need not convert rates themselves; align currency pack denominations with common item prices to reduce inevitable residual change; extend withdrawal channels to unused virtual currency and bundles; and drop blanket virtual-currency-is-non-refundable clauses from terms. Items one and three come straight from the seven principles’ explicit requirements; two and four are natural extensions of eliminating layered conversion — for live-ops teams this is effectively re-auditing the whole monetization system from the ground up.

4. Loot boxes and dark patterns: why variable rewards got priority attention#

If virtual currency is this action’s visible line, loot boxes are the thickest strand of the hidden one. The CPC joint statement’s priority review directions include: loot boxes as variable-reward systems — especially where games are aimed at children or children can actually use them; dark patterns such as misleading countdowns and false scarcity claims; and aggressive commercial practices. The statement puts it harder: some video games directly induce children to consume, a practice explicitly prohibited by EU consumer protection law.

Where is the problem with variable rewards? Mechanically, a loot box turns what you pay for from a certainty into a probability distribution: your money buys a random outcome, with rarer content at lower odds. That variable-reward structure is deeply isomorphic with intermittent reinforcement in behavioral psychology — unpredictable rewards sustain behavior better than fixed ones, which is why the mechanism runs unbroken from physical blind boxes to digital unboxing. For an adult with full legal capacity and a grasp of probability, it may be an entertainment choice. But when a game is aimed at children or children can actually reach the purchase entrance, the nature changes: minors have neither stable spending power nor resistance to probability mechanics and scarcity copy. When the CPC singles out variable-reward systems aimed at or usable by children, it targets exactly that population mismatch.

Dark patterns are the other front. Misleading countdowns — showing only 2 hours left on unlimited stock; false scarcity claims — packaging regular goods as limited-time exclusives; interface designs that make the cancel button one size smaller than the buy button. None of these alone is fraud, but together they systematically distort purchase decisions, making consumers choose under time pressure and information noise what they otherwise would not. Notably, this review is not abstract: specific techniques (countdowns, scarcity claims) were named, which means the market-check stage already collected concrete samples.

5. The parallel track: Italy’s AGCM opens a case on Activision Blizzard#

Beyond the coordinated action, there is a parallel enforcement line: Italy’s competition and market authority (AGCM) has opened an investigation into Activision Blizzard over Diablo Immortal and Call of Duty: Mobile, with consumer protection authorities in Norway and Denmark supporting.

That parallel investigation ranges wider than the CPC’s seven principles, covering seven directions: virtual currency sales, collection of player personal data, potentially addictive design, default parental control settings, direct marketing to children, pre-contractual information, and game account bans. It packages monetization design together with data collection, addiction mechanics and account disposal — regulators now care not only how much you spent but how the system keeps you spending and treats your data and account.

Put the two enforcement lines side by side and the division of labor is clear:

On penalties, per European Pulse, if Activision Blizzard is found to violate the Italian Consumer Code, it faces fines of up to 4% of the prior year’s turnover in each involved country (single source; mind the framing). While 4% is a common statutory ceiling and individual cases usually land far below it, a turnover-based base gives real deterrence against globally integrated operations — this is not a line item in a marketing budget.

6. The industry’s response: a legal characterization fight and six conditional commitments#

The industry responded fast, on two layers: direct legal rebuttal, and operational concession commitments.

On the legal layer, Video Games Europe and the European Game Developers Federation (EGDF) issued a joint statement opposing the CPC’s legal characterization of in-game currency. Their core argument: in-game currency is not a digital representation of value, not a cryptocurrency like Bitcoin — and they cite the Court of Justice of the European Union’s ruling on RuneScape gold as support. This is not nitpicking: if in-game currency falls into a category tightly bound by financial or consumer regulation, the entire stack of issuance, refund and tax obligations changes with it. Behind the characterization fight stands real compliance money.

On the operational layer, the industry offered six conditional commitments:

1. Display the exact real-money price of virtual currency packs;
2. Fully unused bundles refundable in full on request within 48 hours, even where the statutory withdrawal right has been waived;
3. At least 30 days notice before purchased content is removed from sale;
4. Strengthened parental control tools;
5. Compensation for minors’ unauthorized purchases;
6. The sixth commitment was truncated in public reproductions; its full content cannot be confirmed at this time, and we flag that as-is.

Set the commitment list against the seven principles and the tug-of-war’s center of gravity shows:

The industry will concede at the operational layer — real price display, a 48-hour refund window, 30-day delisting notice — but yields nothing at the characterization layer: in-game currency is not cryptocurrency, and any legal characterization implying financial-grade regulatory obligations is rejected. The conditional commitments are precisely bargaining chips: operational concessions in exchange for characterization exemption. Where that fight lands will directly shape how strict the coming legislation is, and it deserves sustained tracking.

7. Spillover: how the EU’s standard reworks F2P, and what players will feel#

Anyone familiar with EU-US internet regulation has the feel: the EU market has long played global compliance first-mover. Mechanically it is simple — a single market plus cross-border coordinated enforcement (Regulation (EU) 2017/2394 is exactly that mechanism) means one compliance retrofit covers all member-state markets; and for globally operated F2P publishers, maintaining a separate commercial implementation just for the EU usually costs more than a global one. So EU-standard design changes tend to flow into every server worldwide with the next version update.

On the player side, if the CPC’s requirements land in stages, the three most noticeable changes: first, purchase pages showing real-money prices directly, and the change-trap misalignment of denominations shrinking; second, refund channels for unused currency and bundles becoming usable — a 48-hour full refund promise, if honored, changes how a good chunk of impulse-purchase regret gets handled; third, 30-day advance notice before delisting or shutdown becoming an obligation, putting compliance friction under the silent removal of purchased content in long-running games.

For publishers, the pressure lands on monetization design freedom: variable rewards, countdown promotions, progression paywalls all get re-examined. Short term that is compliance cost; long term it may not be bad — higher payment transparency swaps information-asymmetry revenue for trust-based revenue, which favors publishers whose life is the long run. The ones truly squeezed are the low-cost reskin products whose business models lean on dark patterns and inducement design.

One more easily missed effect sits on the social and ecosystem side. Long-game payment design is never an isolated system: monthly cards and passes anchor daily activity, bundle rhythms drive guild mobilization, rebate events create return checkpoints. Once the monetization standard shifts, all the outer rhythms get rescheduled. Player communities may complain short term about trimmed events and merged bundles; but if the trade is working refunds, delisting notice and guardrails on children’s spending, the exchange pays off in the mid-to-long term — provided publishers treat compliance as product engineering rather than issuing one announcement and calling it done.

A final note on judging framework: the CPC principles are at this stage a regulatory posture, not statutory law, and both the pace of company implementation and the vigor of national enforcement will vary. The most reliable anchor for evaluating this news is which requirements are written into binding documents and which remain at the commitment layer — which is exactly why this piece kept principles, investigations, commitments and legislation separate.

8. Legislative outlook: the Digital Fairness Act draft and the EU Kids Act#

The coordinated action has a bigger backdrop: two pieces of EU legislation in progress.

The first is the Digital Fairness Act. Per multiple sources, the European Commission intends to publish the draft in November 2026 (note the reportedly-and-expected framing; the exact date is unset). It is expected to codify the CPC’s core principles, covering dark patterns, addictive design, unfair personalization, subscription traps and influencer marketing rules. If codification lands, this action’s weakness — principles without direct binding force — gets patched, and the regulatory ruler upgrades from industry guidance to statute.

The second is the EU Kids Act. A proposal has already leaked, requiring certain online services — including multiplayer games found risky for minors — to run mandatory age verification and banning loot box sales to minors. If it passes in that shape, children-facing loot boxes will be not regulated but banned, a structural blow to any genre built on minor spending.

Put the two EU legislative lines beside the UK timetable and the regulatory rhythm clarifies:

Do not skip the UK comparison items: in 2023 the UK industry published its paid loot box principles; since April 2025 the UK Competition and Markets Authority (CMA) holds stronger direct enforcement powers and has shown willingness to use them; and the UK’s new subscription rules take effect in January 2027. The EU and UK tightening back to back means games monetizing into Europe are entering a period of pressure from both directions.

9. Closing: the player’s view and the operator’s view#

As a longtime dismantler of online payment structures, my most direct impression of this action: the regulator has finally trained its eye on the exchange-rate table, not just the probability table. The loot box debate has raged for years with public attention fixed on whether unboxing is gambling; but the sharpest of the seven principles is the one banning masked spending through multiple currencies and layers — it attacks the pricing foundation nearly all F2P games share. For ordinary players, the three most concrete items are precisely the operational ones: real price display, a withdrawal channel for unused currency, and compensation for minors’ unauthorized purchases.

This is not celebration time, though. Whether the named companies rectify, and whether the CPC action escalates into fine decisions, await follow-ups; the industry-regulator split over the legal characterization of in-game currency is on the table, and November’s Digital Fairness Act draft should be the next hard fight. How the nine companies respond, and whether the six commitments grow or shrink through negotiation, are open questions to keep checking over the coming months. But the direction is clear: free-to-play payment design is moving from boundless creativity to a ruled yardstick. Whether the ruler’s graduations run loose or tight, the next few months will tell. I will keep watching — after all, someone has to do the exchange-rate math for the players.

— Wubian, NTGame Editorial