Policy
Fourth National Lottery Licence: Regulatory Handbook
The Commission’s regulatory handbook sets out our regulatory approach to the National Lottery.
23. Assurance requirements
23.1 Our assurance requirements reflect that we expect the Licensee to take ownership of its decisions, including being able to demonstrate it has followed appropriate processes to consider and mitigate compliance risks. In this section we provide high-level guidance to complement the relevant Fourth Licence conditions that describe assurance requirements, as well as any assurance requirements that may be specified in Section 6 Licences as part of Game Specific Requirements.
23.2 We expect the Licensee to use assurance statements to demonstrate to us it has appropriate processes, systems and governance arrangements in place to mitigate risks of non-compliance. Assurance statements may include evidence from policies and procedures developed by the Licensee to support the delivery of outcomes.
23.3 Where the Gambling Commission requests specific information or assurance from the Licensee, it will act fairly and reasonably (per public law duties), to explain the purpose of its request in the context of its statutory duties and powers, and to determine timeframes for the provision of this information or assurance that are proportionate to the nature of the request, whilst also taking into account any other salient factors depending on the specific circumstances.
23.4 The Licensee must produce an Annual Assurance Statement as set out under Condition 23.17 and 23.18 of the Fourth Licence, and an annual Resilience Assurance Statement as per Condition 18.5, as well as Assurance Statements in other certain circumstances. The Annual Assurance Statement addresses compliance across all areas of the Fourth Licence for the previous Licence Year, whereas the annual Resilience Assurance Statement focuses on ‘forward looking’ compliance over a period of 2 years from the date of the statement, on the financial and operational resilience aspects of the Fourth Licence.
23.5 We expect the Licensee’s approach to be proportionate, including based on the degree of compliance risk identified in different areas of its operations. We expect this to be reflected in the level of detail provided in the Annual Assurance Statement across different areas.
23.6 Following receipt of any Assurance Statements, we will:
- review the adequacy of the statements both in terms of clarity, and in relation to any supporting information available
- adopt a risk-based approach by considering, for example, the materiality of any potential compliance risks, and evidence of appropriate processes to mitigate those risks, and
- depending on the above, seek any further clarification or information from the Licensee. Where necessary we will consider escalation to other enforcement tools.
23.7 In this section we cover guidance on:
- the Annual Assurance Statement requirement
- an Ad-hoc Assurance Statement
- a Resilience Assurance Statement (annual), and
- a Resilience Assurance Statement in the event of a Significant Business Event.
Annual Assurance Statement guidance
23.8 The requirement for an Annual Assurance Statement is set out in Conditions 23.17 and 23.18. A key feature of the Annual Assurance Statement is confirmation that the Licensee has completed the Compliance and Risk Management Audit, which is set out in Conditions 23.13 to 23.16.
23.9 We expect the Licensee to include a sufficient level of supporting information in the Annual Assurance Statement to demonstrate it has appropriate risk identification, mitigation and management processes in place (and that these processes are appropriately enacted). We will then assess whether the level of assurance information is adequate across different business areas. Within our assessment we will also consider and review Licensee performance standards (see Regulatory Reporting Requirements, Table 3).
23.10 Consistent with the requirements set out in Condition 23.18, we expect the Annual Assurance Statement to demonstrate that the Licensee:
- has an accurate understanding of its Fourth Licence obligations
- has complied with the Fourth Licence or, where the Licensee has identified any breaches of the Licence, has taken steps to address any matters giving rise to any breach19
- has appropriate systems and processes in place to allow it to identify, manage and review its risks
- has taken or will take remedial steps to manage and/or mitigate any material risks identified, in a manner that is proportionate to the relevant risks, and
- has satisfied itself it has sufficient and adequate processes and internal systems of control in place to continue to meet its obligations in full.
Ad Hoc Assurance Statement guidance
23.11 We may require the Licensee to submit an Ad Hoc Assurance Statement (see Condition 23.19) outside of the Annual Assurance Statement timelines at certain times. For example, Conditions 10.3 and 10.4 identify some specific circumstances concerned with changes to arrangements related to the distribution of National Lottery products in which we require an Ad Hoc Assurance Statement. We may also require an Ad Hoc Assurance Statement in other circumstances, for example following instances of exception reporting by the Licensee which raise specific concerns (see Condition 24.2).
23.12 The contents of an Ad Hoc Assurance Statement may vary depending on the specific circumstances. Indicatively we expect it to cover areas such as the following:
- the completion of risk assessments across business areas, and the identification of material compliance risk(s)
- assessment of adequacy of existing risk management and development of mitigation plans where applicable, and
- stress testing of business plans and forecasts, where applicable.
Resilience Assurance Statement guidance (annual)
23.13 The Licensee is required to provide, annually, either an Unqualified Resilience Assurance Statement or a Qualified Resilience Assurance Statement, as set out in Condition 18.5.
23.14 Where an annual Unqualified Resilience Assurance Statement is provided, we expect it to demonstrate the Licensee has appropriately identified and managed relevant risks. Among other things, we expect this statement to provide evidence of stress testing, including in relation to business plans and forecasts, and liquidity, equity and profitability. It should also include an assessment of the financial and operational strength of Key Subcontractors and, where relevant, their supply chains.
Resilience Assurance Statement guidance (before a Significant Business Event)
23.15 Unless otherwise approved by us, we require the Licensee to submit an Unqualified Resilience Assurance Statement before it implements a Significant Business Event, as set out in Condition 18.7.
23.16 Where the Licensee provides an Unqualified Resilience Assurance Statement in relation to a Significant Business Event under Condition 18.7, we expect it to demonstrate that the board of Directors of the Licensee have a reasonable expectation that, after implementing the Significant Business Event, the Licensee will have, or will have available to it, sufficient financial and operational resources to operate the National Lottery in compliance with the Fourth Licence for a period of two years from the date of such statement.
23.17 Consistent with Condition 18.7, we expect the Unqualified Resilience Assurance Statement to cover matters such as:
- the nature of the Significant Business Event
- the level of associated regulatory and compliance risks, and
- the approach to mitigating risks and to ensuring that this approach is adequate.
23.18 Within 20 Business Days of receipt of an Unqualified Resilience Assurance Statement related to a Significant Business Event, we may request for the Licensee to provide us with additional information as necessary to understand how the Licensee is managing risks, including:
- assessments of the impact of relevant Significant Business Event on the Licensee’s ability to meet all Licence conditions during the Fourth Licence, and
- performance against risk mitigation plans, business plans, and forecasts.
23.19 Additional guidance related to Significant Business Events is provided separately in section 16, which includes a process diagram (Figure 2) that illustrates how Conditions 18.6 to 18.8 would be applied under the Fourth Licence.
References
19 Note the requirements for exception reporting are set out in Condition 24.
22. Assurance and Regulatory Reporting Requirements context Next section
24. Regulatory reporting requirements (section 1)
Last updated: 1 February 2024
Show updates to this content
No changes to show.