With this document you can:

Print the full document
Save the page as a HTML document to your device
Save the page as a PDF file
Bookmark it - it will always be the latest version of this document

This box is not visible in the printed version.

Raising Standards for consumers - Compliance and Enforcement report 2019 to 2020

The Gambling Commission's report on Compliance and Enforcement action 2019 to 2020. Archived: Report represents information and guidance valid at the time of publication.

Published: 6 November 2020

Last updated: 23 May 2024

This version was printed or saved on: 30 April 2025

Online version: https://www.gamblingcommission.gov.uk/report/raising-standards-for-consumers-compliance-and-enforcement-report-2019-20

Chief Executive's message

Holding an operating licence or a personal licence is a privilege, not a right, and we expect our licensees to protect consumers from harm and treat them fairly.

The aim of our compliance and enforcement work is to raise standards through targeted actions that drive a culture where licensees:

Minimise risks to the licensing objectives and reduce gambling related harm
Treat consumers fairly and communicate in a clear way that allows them to make properly informed judgments about whether to gamble
Work with us in an open and co-operative way
Are deterred from acting in a way that does not comply with either the letter or the spirit of the regulatory framework we set.

In the summer of 2017, we made it clear that we would take a tougher approach to enforcement. At the time, some commentators doubted that we were serious about tougher penalties, but as this report shows, where licensees fail to meet the standards we expect, we will take tough action, including the suspension and revocation of licences. We also indicated our focus was shifting towards personal management licence holders. Those in boardrooms and senior positions need to live up to their responsibilities and we will continue to hold people to account for failings they knew, or ought to have known, about.

Regulatory settlements are a way of resolving enforcement cases which we have used to good effect. Frankly, however, there are too many occasions where settlement proposals are made at a late stage of our investigation process or approached as if a licence review is a commercial dispute to be negotiated. That is not acceptable.

Our Statement of Principles for Licensing and Regulation (opens in new tab) makes it clear that settlements are only suitable where a licensee is open and transparent, makes timely disclosures of the material facts, demonstrates insight into apparent failings and is able to suggest actions that would prevent the need for formal action by the Commission. Only licensees who meet those criteria need make settlement offers; licensees who choose to contest the facts before conceding at a later stage need not make offers of settlement.

In summary, our compliance and enforcement work in the last ﬁnancial year included:

commencing section 116 reviews on 49 PML holders
5 operating licences suspended
11 licences revoked
12 ﬁnancial penalty packages or regulatory settlements – totalling over £30 million
234 security audits and 33 website reviews
350 compliance assessments of land-based and online operators
630 reports of suspicious betting activity, sports rules breaches and misuse of inside information being managed by our Sports Betting Intelligence Unit
over 3,000 intelligence reports being generated.

Everyone has a part to play to make gambling safer and learning the lessons from the failings identiﬁed in this report is one way of doing that.

Neil McArthur Chief Executive

Please note: This year’s report, which covers the period from April 2019 to March 2020, has been published later due to coronavirus (COVID-19) impacts.

Triggers and customer affordability

Customer protection has continued to be a priority for the Commission and consideration of affordability should be a signiﬁcant driving factor in customer risk assessments.

Considering affordability is of signiﬁcant importance to protecting consumers we are consulting on introducing new requirements as part of a strengthened approach to customer interaction. Operators should learn the lessons contained in this report as well as preparing for any new requirements that may emerge from our consultation. Twelve months ago, we recommended that operators reassess their framework on triggers to consider their customer base and individual customer’s disposable income levels as a starting point for setting benchmark triggers.

The intention behind this was to ensure vulnerable customers were identiﬁed as early as possible and interacted with appropriately. Despite this recommendation, the compliance and enforcement teams have continued to review cases where, in the last twelve months, individuals have demonstrated gambling-related harm indicators and still been able to continue to gamble without effective engagement.

Furthermore, these individuals have funded their gambling without satisfactory affordability checks and appropriate evidence being obtained. Casework and compliance assessments which resulted in action being taken by the Commission, have shown:

An online operator permitting a customer to deposit, and lose, £187,000 in two days. This was despite the customer having no regular source of income and funding play from inheritance money or redeposited winnings.
An operator not conducting checks to establish a customer’s source of funds as they had not yet hit any triggers.
A land-based casino customer who lost £18,000 in one year despite having told staff her savings had been spent and that was she was reliant on borrowing funds from family and her overdraft facility to fund her gambling.
A retired land-based casino customer being able to lose £15,000 in 44 days which they could not afford.

Open source data that can help operators assess affordability for GB customers and improve its risk assessment and customer interventions has not notably changed since last year’s enforcement report (opens in new tab).

According to the office for National Statistics Annual Survey of Hours and Earnings:

Median gross weekly earnings for full-time employees in the UK has increased 6.4% to £585 from £550 (2019 provisional and 2018 revised results and 2017 provisional and 2016 ﬁnalised)
The occupation group with the highest median weekly earnings for full time employees is still managers, directors and senior officials for which median gross weekly earnings has increased 4.6% to £862 from £824 (2019 provisional and 2018 revised results and 2017 provisional and 2016 ﬁnalised).

Based on the above, 50% of the full-time employees in the UK receive less than £30,500 gross earning per year and 50% of the full-time managers, directors and senior officials in the UK receive less than £45,000 gross earnings. These earnings are what is received before expenses such as income tax, national insurance, mortgage/rent payments, telephony contracts, travel costs, food and utilities are paid for. We would expect such expenses to be considered in affordability frameworks so the starting point adequately reﬂects the true level of available disposable income for that individual.

Open source information is an important element of an affordability framework because it is a parameter to consider when setting benchmark triggers that will drive early engagement with customers. Officials are aware of affordability frameworks being considered by operators, but they are not being implemented at pace despite our guidance and advice.

We are concerned licensees are creating complex and convoluted matrices and mappings within their affordability framework to place customers into trigger groups well over the gross earnings stated above, before disposable income is factored in. Of more concern, these trigger groups are set without any sort of customer interaction to inﬂuence their true affordability determination. Operators must interact with customers early on to set adequate, informed affordability triggers to protect customers from gambling related harm. Failure to do so could render the operator non-compliant.

Customers wishing to spend more than the national average should be asked to provide information to support a higher affordability trigger such as three months’ payslips, P60s, tax returns or bank statements which will both inform the affordability level the customer may believe appropriate with objective evidence whilst enabling the licensee to have better insight into the source of those funds and whether they are legitimate or not.

We appreciate that operators have established customer bases and these customers will either be in a loss position or a proﬁt position with the operator. For customers in the loss position a sensible approach would be to assign the customers a national average affordability trigger, irrespective of historical deposits and withdrawals, and move these customers to higher affordability triggers once appropriate affordability evidence is received.

For customers in a proﬁt position, operators may have adopted a framework which allows triggers to be moved up from the national average without affordability evidence as their winnings are evidence of what these customers can afford. With this type of customer, we would expect an operator to still be considering affordability whilst also monitoring the customers play activities to be satisﬁed that they are not exhibiting signs of gambling-related harm. This especially applies to large one-off winners such as jackpot winners.

If winning customers are not being asked for affordability evidence but are withdrawing and redepositing funds, we consider checks are required to mitigate any Social Responsibility or Money Laundering risks as customers could be misappropriating funds and re-depositing fresh criminal spend the operator mistakenly believes are previous winnings.

Operators need to consider this and obtain evidence when appropriate to satisfy themselves that this is not the case.

At the time of writing this report, the long term ﬁnancial impact of the coronavirus (COVID-19) crisis is yet to be fully understood, although initial data analysis (opens in new tab) published by the Commission indicated that 40% of people saw a decrease in their disposable income. This was occurring whilst 20% of the population reported a decrease to their mental health and during lockdown may have sought additional forms of entertainment, or to replace betting activity no longer available such as on live sports.

In response to evidence showing some gamblers maybe at greater risk of harm during lockdown, the Commission published new guidance for online operators to help reduce the risk of harm in these unprecedented circumstances. The guidance clearly sets out that we expect operators to:

Urgently review their thresholds and triggers to reﬂect the change in circumstances, adopting a precautionary approach.
Keep under review duration of play for customers which can be an indicator of harm and keep this under review to identify changes which warrant intervention.
Conduct effective affordability checks during the life of the customer relationship but particularly during this crisis.
Prevent reverse withdrawals which has been linked to problem gambling behaviours and harm.
Restrict bonus offers to those displaying indicators of harm.

The Commission recommended operators urgently, given the impact of coronavirus, revisit their framework on triggers and consider their customer base and their disposable income levels as a starting point for benchmark and affordability triggers, building upwards, to ensure vulnerable customers are identiﬁed as early as possible and interacted with appropriately. Knowing and identifying customers at risk of or experiencing harm and acting early and quickly could help stop or prevent any harm worsening. The Commission continues to monitor the impact of coronavirus.

Customer Interaction and Social Responsibility failings

The Gambling Commission exists to safeguard consumers and the wider public by ensuring that gambling is fair and safe.

We are committed to making gambling safer and we do this by placing consumers at the heart of regulation and maintaining the integrity of the gambling industry. Safer gambling (also known as Social Responsibility) is all about protecting people from gambling-related harm.

The Compliance team measures operators against the Social Responsibility code provisions by undertaking operator assessments, reviewing operator commitments such as Assurance Statements or by way of thematic work. Typically, the areas where operators fall down are:

Safer gambling policies have not been reviewed to consider new guidance and/or have never been tested for effectiveness.
Operators do not follow their own policies and procedures and there is a lack of rigorous senior management oversight.
Triggers are not appropriate, are ineffective, or occur one time only, and sometimes it is a combination of all three factors.
Interaction impacts are not reviewed, measured, or acted upon. We still see instances where customer calls are scripted or based around closed questions.
Staff accept customer responses at face value without considering other information available such as affordability based on their speciﬁc circumstances.
Interactions are not carried out due to historic interaction records which may not be reﬂective of current circumstances.

We have set out clear expectations for operators in relation to safer gambling. We expect operators to actively work and accelerate cooperation with each other to prevent, mitigate and minimise harm, collaborating to accelerate progress and evidence impact. We want a focus on ‘what works’ and we expect operators to empower and protect consumers.

This area of regulatory oversight is broad and includes proper identiﬁcation and engagement with those who may be at risk of or experiencing harms; ensuring terms and conditions are clear, fair and straightforward; ensuring they do not target people who may be vulnerable and properly supporting self-excluded customers.

Over the past year, we have continued to take action where operators are not doing enough to identify and engage with customers who may be at risk. We have continued to see incidences of customers who were experiencing signiﬁcant problems with their gambling being upgraded to ‘VIP’ status, with operators missing the clear signs of harm as they focus on proﬁt. We have also experienced repeated examples of customers being allowed to gamble signiﬁcant sums of money in short time frames, way beyond their personal affordability, without any operator intervention. These problems can be particularly acute over weekends and during the night.

We will continue to take a ﬁrm regulatory enforcement approach whilst also further improving gambling harms research and evaluation so there is widespread adoption of what works.

Operators are encouraged to reﬂect on their performance in this area, and in particular to consider whether they can evidence the following:

They have effective safer gambling policies and procedures in place which are tested and periodically reviewed and updated to reﬂect impact assessments and new research.
They check to make sure the policies and procedures are truly implemented in the business and are being acted upon.
Appropriate safer gambling triggers are in place that lead to meaningful customer interactions. Those interactions should be regularly reviewed by management to critically assess their impact on customers and overall effectiveness.
There should be effective challenge and oversight by senior management with clear accountability throughout the organisation.
That the teams responsible for conducting Social Responsibly interactions are adequately resourced so that at-risk customers are not missed or identiﬁed too late.

Enforcement cases:

We have taken regulatory action against several licensees who failed to meet customer interaction requirements to identify and appropriately progress customers who are or may be problem gamblers. Notable cases included:

Case studies

During one compliance assessment of an online casino operator, which led to a licence review, officials found:

Despite the existence of triggers based on loss and length of play, a customer lost £53,000 in 12 weeks following registration of their account.
In one gaming session lasting over 7 hours, their losses amounted to £16,500 and the only interaction during this time was to ask the consumer to conﬁrm a new card to make payment was theirs. In a subsequent session also lasting more than 7 hours, no interactions were made with the customer that day.
During the 12-week customer relationship, the only safer gambling interaction was a brief three question email to which the customer responded ‘I am ﬁne, please don’t deactivate my account’. This was not followed up or challenged
The customer ﬁnally self-excluded.

Action was taken against one online bingo operator when it was discovered:

One customer had generated 56 automated ‘pop-up’ safer gambling messages and 13 in-play messages whilst still being able to continue without restrictions or there being more meaningful interactions.
Despite the customer displaying concerning behaviour linked to speed of losses and length of play, automated bonuses were placed into their account.
The operator could not evidence that it had monitored either the effectiveness of its safer gambling messaging, nor the speciﬁc customer interactions.

Other online operator failings which resulted in Commission action include:

A failure to carry out social responsibility interactions with a customer who lost £98,000 over two-and-a-half years, had 460 attempted deposits into their account declined, and asked the operator to stop sending them promotions.
Allowing a customer to spend £1.5m over 34 months without being able to provide evidence of any social responsibility interactions being carried out. The customer displayed signs of problem gambling including logging into their account an average of 10 times a day for a month.
Not being able to provide any evidence of carrying out social responsibility interactions with a customer who deposited over £140,000 in the ﬁrst 4 months of their account being open.
An operator identifying concerns with a customer, who was then allowed to gamble signiﬁcantly without additional steps being taken to verify the affordability of the losses.
A repeated self-excluded customer being permitted to lose £50,000 in 1 day
A customer with 11 accounts being permitted to deposit more than £494,000 in 17 months, with £300,000 of this being deposited in just 5 months. No evidence of social responsibility interactions could be provided by the operator.

Areas for improvement are not limited to online operators. In one assessment on a land-based casino we found:

A customer who was known to have previously self-excluded losing £240,000 in 13 months.
A customer displaying signs of problem gambling, including 30 sessions lasting more than ﬁve hours, losing £323,000 in 12 months.
Ineffective interactions with customers displaying indicators of potential problem gambling including violent outbursts, threats to staff and damage to property.
Customers simultaneously seeking return of winnings to their personal bank accounts to prevent further play, whilst seeking to increase the maximum they could deposit by cheque.

You should be asking yourself the following key questions with regards to customer interaction and identifying problem gamblers:

Do you have policies and procedures in place to identify customers who may be experiencing or at risk of developing problems with their gambling? Have you allocated sufficient resources to be able to interact with customers early and effectively when you have concerns?
Are you curious about your customers? Do you monitor customer activity? Do you record interactions and use this information to aid your decision making about customers?
Do you track customers across your different platforms and do enough to spot multiple customer accounts?
Do you have systems in place to identify potential problem gamblers? Do these include appropriate and realistic trigger points linked to individual affordability considerations for when the usual pattern of gambling becomes unusual (these should not be just ﬁnancial)? How do you protect new or unknown customers (where a pattern of play cannot yet be established)?
Will your processes keep pace with increased demand? Will your growth or any merger affect your ability to monitor customers?
How are you evaluating these measures and procedures to ensure they are effective and how do you plan to make improvements over time?
Are your staff sufficiently trained to spot gamblers who might be experiencing harm and know how to report concerns? Are there clear procedures once a concern has been raised? Are there processes in place for weekends and late nights?
Where concerns arise, are you able to intervene early and engage with a customer?
Do your customer interaction policies and procedures also cover VIP customers? Are you alert to the particular risk these customers may face? Are commercial considerations overriding customer protections? Are you answering these questions before offering VIP status to ensure you are minimising harm from the outset of the VIP/high spend relationship?
Have you considered how you will meet the revised LCCP requirements for customer interaction? Have you reviewed your own processes against the guidance, and considered changes you need to make to meet the requirements from October 2019?

Anti-money laundering and counter terrorist ﬁnancing

Work to ensure gambling stays free from crime and the proceeds of criminal ﬁnance continues to be a major area of concern for the Commission. Signiﬁcant and substantial assessment continued for both land- based and online gambling businesses, including money service businesses activities offered by the casino sector.

Compliance activity and enforcement cases continue to show that some licensees’ money laundering (ML) and terrorist financing (TF) risk assessments, and policies, procedures and controls are not ﬁt for purpose.

We expect licensees to comply fully with the terms of their licence as relevant to anti-money laundering (AML) and counter terrorist ﬁnancing (CTF). Casino licensees must additionally comply with the requirements of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the Regulations), and pay close regard to the various guidance documents we publish which are available on the AML section of the Commission’s website. We provide regular updates on AML and CTF matters on our website and through industry newsletters.

There continues to be a lack of understanding of how to conduct a robust and appropriate risk assessment for the prevention of money laundering (ML) and terrorist ﬁnancing (TF) for gambling businesses.

Areas where operators fall down often include:

Insufficient depth of knowledge demonstrated by Personal Management Licence holders which has led to concerns as to competency and integrity.
Operators adopting a ‘one size ﬁts all’ approach to their Risk Assessment when it should be tailored to the speciﬁc ML and TF risks pertinent to their business
Failure to adequately demonstrate their Risk Assessment has due regard to the Commission’s Risk Assessment and that they are keeping up to date with ﬂuctuating standards in alternative jurisdictions whilst rigorously meeting GB legislation and standards.
Where the over-arching Risk Assessment is deﬁcient, this can naturally lead to ineffective policies, procedures and controls.
Operators and PML holders failing to learn lessons from the Commission’s compliance and enforcement activity.
Failure to provide regular, quality training to staff including Money Laundering Reporting Officers and Nominated Officers and possess sufficient ‘Know Your Employee’ data.
Demonstrating a static and ineffective approach to customer risk proﬁling and enhanced customer due diligence when it should be dynamic and capable of identifying both current and developing risks.

We are encouraged to see positive examples where some operators have more closely integrated their VIP management teams with their AML and CTF teams. Integrating social responsibility and the prevention of ﬁnancial crime, which are frequently co-dependent issues, is a positive and encouraging improvement and we encourage other operators to consider embedding this approach into their existing practices. We have also been encouraged by signiﬁcant investment by some operators in systems and techniques to proﬁle customers. AML and CTF are areas where collaboration and evaluation of what works could be shared between operators to reap additional beneﬁt for themselves and consumers.

Our notable enforcement cases

Case studies:

Further failures at land-based casinos which resulted in Commission action include:

Failures to carry out effective source of funds checks, including on one customer who was allowed to drop approximately £3,500,000 and lose £1,600,000 over three months.
Failure to obtain adequate source of funds evidence for a politically exposed person (PEP) who lost £795,000 over 13 months.
Failure to carry out enhanced customer due diligence on a customer who lost £240,000 over 13 months.
A customer whose stated profession was a waitress who was allowed to buy in for £87,000 and lose £15,000 over 12 months.

Online licensees’ compliance and enforcement activity revealed:

A customer who had been the subject of 18 risk and fraud team reviews being permitted to deposit more than £494,000 over 17 months. The customer was subsequently convicted of fraud.
An operator failing to independently verify source of funds information originating from the customer and relying on only open source checks and representations by the VIP manager. The customer was able to deposit more than £8,000,000 in 4 years until the account was ultimately closed following police contact.
An unemployed customer depositing £1,600,000 and losing in excess of £700,000 over three years. The operator failed to conduct independent checks and relied upon open source information and unveriﬁed information from the customer
A customer being permitted to deposit over £1,000,000 and lose more than £270,000 despite their level of activity and spend not being supported by their stated income, their use of a business bank account, providing an address different to that linked to either bank account and the identiﬁed use of pay day loans.

Good practice

During the year we published advice to operators through public statements. You should consider the following to ensure you are complying with the terms of your licence:

Is risk being ‘owned’ at an appropriately senior level within your business, and are conﬂicts of interest avoided? If a casino business, do you have a Senior Manager or a Board Director who has oversight of AML and CTF compliance? Have you notiﬁed the Commission who this is? Do you inform the Commission of changes to those positions within 14 days?
Are you conﬁdent commercial considerations do not outweigh your regulatory responsibilities and compliance with the conditions of your licence?
Is your money laundering and terrorist ﬁnancing risk assessment appropriate to your business? Have you taken into account the Commission’s Money Laundering and Terrorist Financing Risk Assessment, and the high-risk factors detailed in our guidance?
Have you ensured you have clear, up to date, and ﬁt for purpose AML and CTF policies, procedures and controls available to all who require guidance within your business?
Have you reviewed your risk assessment, and policies, procedures and controls in accordance with your licence requirements?
Have you ensured your policies, procedures and controls have been informed by our most up to date Commission guidance for AML and CTF? Are you assuming if you comply with the AML and CTF requirements of an overseas regulator that you are in compliance with the Commission’s requirements?
Are your policies, procedures and controls informed by the risks identiﬁed in your business’s money laundering and terrorist ﬁnancing risk assessment? Are they revised when the risks change? Are they revised when the Commission publishes information on emerging risks or revises its guidance?
Are your systems and controls appropriate for your business? Do you regularly assess the adequacy of your systems and controls and their effectiveness in mitigating your business’s identiﬁed money laundering and terrorist ﬁnancing risks?
Do you ‘Know Your Customer’ (KYC) and are you gaining a complete picture of the customer’s source of funds, particularly in relation to VIP customers and PEPs (casinos only)? Are you critically assessing assurances you receive as to your customer’s source of funds? Are your procedures triggered at an appropriate stage of the relationship with the customer?
Do you require customers to provide their occupation upon registration and then proﬁling their income for affordability? Are you considering whether a declared occupation poses an increased risk of money laundering or terrorist ﬁnancing?
Are your customer risk proﬁles informed by your money laundering and terrorist ﬁnancing risk assessment, or are they treated as separate exercises with a disconnection between the risk assessment and risk proﬁles? Is your ongoing monitoring of customers sufficiently risk sensitive and timely?
Are you placing an over-reliance on monetary thresholds for customers’ risk triggers and ignoring other risk factors, such as source of funds, affordability and jurisdictional risk? Are you sufficiently curious about your customers source of funds and, if a Politically Exposed Person (PEPs), their source of wealth (casinos only)?
Is the level of customer due diligence (CDD) you conduct on speciﬁc customers informed by their risk proﬁle? Do you scrutinise transactions to ensure they are consistent with the customer’s risk proﬁle?
When conducting enhanced customer due diligence (ECDD) upon your customers (casinos only), are you being sufficiently curious about their source of funds, jurisdictional risk, product choice, and payment method and channel used, and considering what that means to your business and how it increase ML and TF risks?
Have you allocated sufficient resources to AML and CTF compliance within your business? Do you have an identiﬁed Nominated Officer (casino only) and/or Money Laundering Reporting Officers (MLRO)? Does your business give adequate resources to the NO and/or MLRO to undertake their speciﬁc legal duties sufficiently?
Do you have an accessible policy for employees setting out the role of the NO and/or MLRO within your business, and how employees can submit internal reports of suspicion of ML and TF to the NO and/or MLRO, including what employees should or should not do following such an internal report?
Are you regularly training employees about their AML and CTF responsibilities? Are you retaining records of AML and CTF training for future scrutiny? Are emerging risks, lessons learned from enforcement action and known risks provided to employees, to ensure that their knowledge is current for ML and TF risks?
Are you supporting your nominated officer with the appropriate resources and training, and do they have the authority to operate objectively and independently?
Is your approach based on a framework to mitigate risk? Once an internal money laundering alert has been raised, do you have in place procedures to ensure the alert is properly reviewed in a timely manner? Are decisions appropriately recorded, retained and available for scrutiny?
Have you ensured your staff have, and continue to receive, adequate training on AML and CTF matters, including how to recognise and deal with unusual transactions, account behaviour and other activities which may indicate money laundering or terrorist ﬁnancing activity?
Are you making records of customer interactions and transactions where necessary? Are you making records of your decisions as a MLRO and/or a NO in respect of customers, and decisions to report or not to report suspicions to the United Kingdom Financial Intelligence Unit?
Do you have sufficient oversight of third-party partner’s compliance with your licence conditions when promoting gambling facilities on your behalf? Are customer interactions and source of funds records being maintained? Are third-party employees acting contrary to your licence conditions and exceeding the terms and conditions of the service agreed with them?

Personal Management Licence Reviews

The Commission has been signalling for the past few years that we will increasingly focus on the role played by Personal Management Licence holders (PML) when undertaking Compliance and Enforcement investigations.

PML licences are required to be held by anyone with responsibilities for:

Overall strategy and delivery of gambling operations
Financial planning, control and budgeting
Marketing and commercial development
Regulatory compliance
gambling related IT provision and security
Management of licensed activity for a particular area in Great Britain where you have ﬁve or more sets of premises for which you hold a premises licence.
Management of a single set of bingo and/or casino licensed premises.

We recognise that these roles can be challenging and we have seen progress in leadership within companies as Board and Executive teams drive cultural change. Sadly, we continue to identify failings and had to sanction individuals fulﬁlling these roles.

Common failings have emerged from:

Failures to assess if decisions being made at Executive level are being implemented within businesses. Often linked to the risk framework of the business not being robust and challenging questions not being asked.
Overly complicated lines of decision making and accountability, with PML holders unclear who was responsible for issues, particularly when passed from premises to headquarters and back.
Lack of technical knowledge and oversight of areas they have speciﬁc responsibility for, especially in respect of AML.
Prioritising commercial outcomes over regulatory responsibility.

The Commission expects PML holders to adhere to the terms of their licence in particular; ‘Suite of general conditions to be attached to personal licences under Section 75 of the Gambling Act 2005’, which includes:

‘Personal licence holders must take all reasonable steps to ensure that the way in which they carry out their responsibilities in relation to licensed activities does not place the holder of the operating or any relevant premises licence in breach of their licence conditions’.

The Commission’s Statement of principles for licensing and regulation (June 2017) (section 4.3) sets out that we expect individuals occupying senior positions, whether or not they hold PMLs, to, amongst other things:

Uphold the licensing objectives and ensure compliance of operators with the Licence conditions and codes of practice (LCCP).
Organise and control their affairs responsibly and effectively.
Have adequate controls to keep gambling fair and safe.
Conduct their business with integrity.
Act with due care, skill and diligence.
Have due regard to the information needs of consumers and communicate with them in a way that is clear, not misleading, and allows them to make an informed judgment about whether to gamble.
Manage conﬂicts of interest fairly.
Disclose to the Commission anything which the Commission would reasonably expect to know.
Work with the Commission in an open and cooperative way.
Comply with both the letter and spirit of their licence, the licence of their operator, and associated Commission regulations.

We have an expectation that senior PML holders ask questions, intervene and ensure compliance with the licence conditions. We will continue to hold PML holders to account for when there are regulatory failings within operators and PML holders fail to take appropriate and reasonable steps in a timely manner to halt these breaches.

During this reporting period we have commenced section 116 reviews on 49 PML holders. Outcomes have included the requirement for training, additional licence conditions, warnings and licence revocations. Cases resulting in warnings over the past year included:

A Director of Gaming at a land-based casino who played a role in failing to ensure a casino complied with the requirement to complete a risk assessment, had appropriate policies, procedures and controls to prevent money laundering and terrorist ﬁnancing and comply with social responsibility code of practice requirements.
A Money Laundering Reporting Officer (MLRO) at a land-based casino who failed to ensure a casino had put into effect adequate anti-money laundering controls (including a risk assessment) and the requirements of social responsibility Code 3.4.1.
An MLRO of an online casino who failed to ensure the licensee had in place an adequate risk assessment with effective underpinning policies, procedures and controls. The risk assessment and policies and procedures should have been implemented effectively and kept under review to mitigate the risk of money laundering and terrorist ﬁnancing.
A PML holder responsible for overall management and direction of an online operator who failed to adhere to Licence condition 1.2.1(1) by ensuring that the person occupying a key position held a personal management licence (PML).They also failed to put into effect adequate anti-money laundering controls (including a risk assessment) and notify the Commission of a key event – that a person holding a key position had ceased to occupy that position.
A PML holder responsible for regulatory compliance at an online operator who failed to ensure the licensee had put into effect adequate anti-money laundering controls (including a risk assessment).

The Commission has previously communicated its acknowledgement that businesses do not make decisions – people do. Licensees can expect us to continue to take action against accountable individuals to ensure standards are raised to the levels required, whether in relation to the business or individual capability.

Illegal gambling

Part of our statutory remit and a key licensing objective is to keep crime out of gambling. We are particularly focused on identifying and disrupting those illegal websites which are targeted at the young and vulnerable gamblers and which often provide little, or no, customer protection. When consumers access illegal gambling sites, they expose themselves to many risks and are not afforded the protections in place in the regulated sector.

We assess intelligence gathered from multiple sources and work closely with partner agencies to prevent access to illegal websites by GB consumers. If an intelligence-led approach is unsuccessful, cases are referred to the Enforcement team for investigation and focused disruption. This approach ensures that our focus is on those websites presenting the greatest consumer threat. Our focus has been on investigating Section 33 Gambling Act offences – making available unlicensed gambling facilities, and Section 330 Gambling Act offences – unlicensed advertising of such facilities. Our investigations have shown:

Consumers identiﬁed as users of the websites have in the main been vulnerable with some having previously self-excluded via GamStop
Consumers often contact the Commission because they have been unable to withdraw funds.
When consumers have complaints with unlicensed operators these are often not dealt with, and consumers have no right to appeal.
The protection of consumers’ personal information cannot be relied upon.
Such websites may be linked to organised criminality.

We continue to have a staged approach and when we become aware of suspected individuals or companies who may be offering unlicensed gambling facilities to GB consumers our initial action is to issue cease and desist demands. Where this is not adhered to and GB consumers remain at risk, we use disruption techniques where appropriate. Our methods have included utilising our relationships with web hosting companies to bring down websites, payment providers to remove payment services and social media sites to prevent websites appearing on search engines or being hosted. All of these methods ensure that we continue to react proportionately and appropriately to the illegal provision of gambling facilities and prevent unlicensed operators interacting with GB consumers.

Enforcement have tackled 59 instances of remote unlicensed operators this year and engaged with 15 international regulators. We will continue to put out messages on our media feeds and website to ensure consumers know the risks of using such sites.

We urge licensed entities to remain vigilant as to the risk of these illegal sites using their software without authorisation and to report any such instances to us immediately.

We continue to investigate allegations of cheating under s.42 of the Gambling Act where appropriate and work together with sports governing bodies and betting operators in tackling this type of crime. In this year two possible criminal investigations were considered for action.

We continue to support/have provided support to police forces within the United Kingdom with their criminal investigations and provide advice through NPCC stakeholder engagement.

Social media lotteries are a growing issue due to their increasing presence on Facebook and other sites. Historically such lotteries were low-level events, and intelligence identiﬁed many were being run from home by a small group of people and for low value prizes. However recent intelligence suggests larger, more organised operations may be in effect, generating signiﬁcant proﬁt for the individuals ultimately controlling these. From May 2019 to May 2020, 245 illegal lotteries were referred by us to Facebook for closure.

The protection of vulnerable consumers is a core licensing objective and continues to be an enforcement priority. The Commission will take strong and proportionate action when unlicensed websites or illegal lotteries are seen to be targeting vulnerable consumers who are most at risk of experiencing gambling harm.

Case study

The Commission became aware of unlicensed websites being promoted to gamblers who had self-excluded from GAMSTOP. Since 1 April 2020, licensed operators are required to adhere to social responsibility code provision 3.5.5 – which requires that all online operators are fully integrated with GAMSTOP. This ensures that vulnerable consumers are able to self-exclude from all online gambling products.

Those advertising these unlicensed websites may have been committing a criminal offence under Section 330 Gambling Act offences (unlicensed advertising of such facilities).

Once the Commission became aware of these websites, we utilised our criminal powers to investigate and disrupt these websites through liaising with website hosting services, search engines, social media, payment service providers and licensed software providers of popular casino games. This was a cynical, targeted effort to attract those most at harm and demonstrates the very real risks individuals can be exposed to should they choose to gamble with an unlicensed operator.

White Label Partnerships

The white label operating model continues to be popular within the GB market with there being over 700 white label partners within the industry at present. One of the reasons this model is becoming increasingly popular is that this type of arrangement can bring global exposure to an operator’s products, via the arrangements their white label partners have in place with sports teams for example. However, there is a concern that unlicensed operators who would potentially not pass the Commissions’ initial licensing suitability checks, are looking to use the white label model to provide gambling services in Great Britain.

Therefore, it is essential that UKGC licence holders conduct appropriate due diligence checks on their prospective white label partners before entering into a business relationship. Responsibility for compliance will always sit with the licence holder so they should satisfy themselves appropriate safeguarding measures and controls are in place before committing to contractual obligations to ensure compliance with LCCP SR Code provision 1.1.20 Responsibilities for Third Parties. Failure to do this may bring into question the suitability of an operator to hold a licence.

In the last year the Commission has conducted compliance and enforcement work focused on this speciﬁc area. That work revealed licensees were failing to appropriately mitigate the risks to the licensing objectives. A failure to properly scrutinise ownership of the white label partners, address money laundering and politically exposed person’s (PEP) risks and general poor oversight of activities completed by such partners led to the Commission producing revised guidance to remind operators of their obligations. Areas where operators fell down were:

Passing responsibility for customer interactions to their partners with a lack of effective oversight.
Operators not having live access to customer interaction records leaving them unable to ensure their partners are upholding the licensing objectives and that customer risk is being managed effectively.
Being unable to monitor customer spend, length of play and behaviour across all partners in their domain preventing a holistic single customer view.
Ineffective AML controls in place with individual partners or when viewed across the entire domain for customer activity.
Little, or no control over marketing and promotional offers published by their partners leaving customers exposed to potentially unfair or unclear material. Some promotional material may have appeared on copyright infringing websites
Insufficient due diligence being conducted on partners who had links to criminal activity.

Operators should:

Conduct risk-based due diligence with a view to mitigate risk to the Licensing Objectives before entering a relationship with a white label partner.
Continually manage and evaluate its white label partner relationships.
Ensure service agreements between the licensee and white label partner explicitly articulate where overall responsibly for regulatory functions lie.
Ensure white label partnership contracts contain a clause permitting the licensed operator to terminate the business relationship promptly where the partner is suspected to place the Licensing Objectives, as set out in the Gambling Act 2005, at risk or fails to comply with the requirements contained in the LCCP.
Provide training to their partners and conduct ongoing oversight of the activities which should be clearly documented and retained for the life of the business relationship.
Ensure that any system the licence holder has in place to manage or detect multiple accounts for individual customers works across all white label partners so they will have a holistic view of customer activity.
Ensure that source of funds, affordability or markers of harm triggers are based upon this holistic view and not solely on an individual domain basis. Failure to do so conﬂicts with the licensing objectives to keep crime out of gambling and to ensure vulnerable people are protected. A single customer view will always be desirable.

Notable Enforcement Cases

Case Studies

Licensees with white label partnerships:

Conducted ineffective customer interactions and source of funds checks on a customer displaying signs of problem gambling. That customer was able to spend £282,000 over 18 months.
Sent marketing material to over 2,000 previously self-excluded customers.
Had a VIP team manager in place who had neither effective oversight nor sufficient AML training.
Allowed an affiliate to place inappropriate banner advertisements on a Great Britain facing website which provided unauthorised access to copyrighted content.
Enabled a customer to create 14 accounts across the operators domain before being detected. This customer lost £209,000 without checks taking place.

As a reminder to all online operators, it is important that you inform the Commission of any white label agreements you enter into as part of the key event reporting process. Operators are encouraged to read our advice and guidance on white labels.

Betting Exchanges

This year has seen increased regulatory activity related to betting exchanges; an area of growing complexity as operators expand the breadth of markets available and the jurisdictions from which they draw their customers.

There is no ambiguity for the Commission in respect of the standards we expect to be applied to any bet struck under our licence. It needs to comply fully with requirements of the Gambling Act and the LCCP including Social Responsibility and AML provisions.

Operators of betting exchanges must apply critical risk-based thinking in advance to address these challenges- assuming something good enough for one regulator will be acceptable to another is ﬂawed and is not likely to withstand our scrutiny if we believe an inferior standard is being fulﬁlled instead of GB requirements.

The most prominent Enforcement matter this year related to the activities undertaken by Triplebet Ltd who trade as Matchbook. They were licensed in Alderney and by the Gambling Commission. They were taken before a regulatory panel and subject to a substantial penalty including the suspension of their licence. Failings revealed in their framework for managing an exchange are applicable for consideration by all such GC licensed operators.

Account to account transactions

Triplebet had permitted account to account transactions, whereby one customer can move money to another customer or account, or even another account in his/her name, including abroad, without the kind of controls which would attach to banking transactions for similar amounts and creating an appearance of legitimate monies to be withdrawn or spent.

Money laundering risks included:

Prior to October 2017, account to account transfers were not documented at all.
Transfer request documents post-October 2017 failed to record the reason for the transfers.
There were instances of customers transferring monies after depositing them with little or no play.
There were examples of single customers being listed against different countries and/or making transfers between accounts in their own name.

Between November 2014 and May 2018, approximately £3.2 million and $2.4 million was transferred from GB customers to non-GB customers, with £1.1 million and $1.8 million passing in the other direction.

Triplebet could not produce any record of it refusing account to account transfers.

In the absence of adequate checks and controls, account to account transfers of this nature are highly risky from a money laundering and terrorist ﬁnancing point of view, as customers can transfer money between themselves or may borrow money from unconventional sources, including other customers, which can offer criminals an opportunity to introduce criminal proceeds into the legitimate ﬁnancial system through gambling accounts. It also allows criminals and terrorist ﬁnancers to transfer value between each other in a way that it goes undetected and remains outside of the traditional ﬁnancial sector. In this case, the transfers may also have unwittingly facilitated international money laundering and terrorist ﬁnancing.

Syndicate

One of Triplebet's main customers was a syndicate, whose lead contributor was a professional gambler, who also held a beneﬁcial interest in Triplebet itself. Over an 18-month period from November 2016, the syndicate matched bets on the Exchange totalling in excess of $55 million, without any documented risk assessment.

Triplebet submitted that its actual customer was the lead contributor of the syndicate and that therefore there was no obligation upon it to ascertain the identities of the other contributors or consider their source of funds or source of wealth. The Panel found that the consequence was that gamblers had been permitted to gamble very large sums without due diligence.

Due Diligence must be undertaken for each individual customer

The Gambling Commission's Social Responsibility Code requires licensees to interact with customers in a way which minimises the risk of gambling-related harm.

The Panel determined that, in breach of the Code, Triplebet had failed to put into effect its policies and procedures for customer interaction in a number of cases. These included:

A player who gambled a large sum of money on one day from 2.30am to 4.30am, again at 7am, 8am to 11am, 12pm to 12.30pm and 11pm to 12am, with a similar pattern the following day, and no interaction whatsoever.
A player who registered, played and self-excluded on the same day, re-opened his account six months later, playing for 10 hours a day on two consecutive days and nights, and then losing a large sum in a single day before self-excluding again, all without any monitoring or interaction.
A gambler who lost $714,000 in a year, without any evidence of due diligence being carried out by Triplebet.

Triplebet policies had failed to comply with the Social Responsibility Code provision then in force, by failing to refer to indicators such as time or money spent, and also by failing to contain speciﬁc provision in relation to ‘high value’ or ‘VIP’ customers. This in turn led to Triplebet's failure to identify and sufficiently interact with a number of at-risk players and also syndicates.

Triplebet accepted that the structure of syndicates resulted in customers not being appropriately assessed from a social responsibility perspective.

Monitoring of business relationships

The Panel found that Triplebet did not conduct appropriate ongoing monitoring of business relationships in several respects, including the following:

Monitoring did not place sufficient emphasis on addressing anti-money laundering risks.
There was insufficient recording of outcomes of monitoring.
Monitoring did not always result in appropriate steps being taken in accordance with Triplebet's procedures, which resulted in too little emphasis on obtaining documentary evidence, including evidence relating to source of funds.

In several cases, customers had been permitted to gamble very large sums without any checks of their source of funds or source of wealth. In one case, a customer put at risk over £2 million in a single day without any source of funds or source of wealth being required. In another, a customer deposited and shortly afterwards withdrew a large sum of money without any gambling activity, a risk factor for money laundering, yet Triplebet had carried out no checks on the customer other than to verify his identity and address one year earlier.

The Panel rejected Triplebet’s submission that professional gamblers are a known low risk category for money laundering, since money laundering includes the simple use of criminal funds to fund gambling as a leisure activity, and criminals may also be gamblers.