This box is not visible in the printed version.
The enforcement report for 2018 to 2019. Archived: Report represents information and guidance valid at the time of publication.
Published: 27 June 2019
Last updated: 23 May 2024
This version was printed or saved on: 14 October 2024
Online version: https://www.gamblingcommission.gov.uk/report/raising-standards-for-consumers-enforcement-report-2018-to-2019
This report – the Gambling Commission’s second annual enforcement report – provides an overview of the enforcement work we have undertaken over the past year and the lessons that operators should learn from that work.
We want as many people as possible within the gambling industry to read this report. More than anything, the report is intended to be a support tool which the industry can use and digest the lessons to be learned for the future.
The aim of our enforcement work is to protect consumers and the wider public and to raise standards in the gambling industry through targeted actions that drive a culture where operators:
During 2018-19 we have seen progress in some areas, which we welcome and want to build on, but there have still been too many occasions where we have had to step in with tough action to protect consumers and the wider public. For example, we have carried out a substantial number of investigations into online gambling operators. Several online casino operators and members of their senior management have been sanctioned at the conclusion of those investigations due to social responsibility and anti-money laundering failings. Enforcement action this financial year has resulted in £19.6million in penalty packages, the surrender of three Personal Management Licences, warnings for four PML holders and two advice as to conduct notices for PML holders.
In total we carried out more than 160 regulatory and criminal investigations last year, an increase on previous years. We also dealt with 2,000 intelligence reports and carried out hundreds of risk-based compliance assessments.
On a more positive note, we have also worked with operators to raise standards by successfully launching a programme of co-creation workshops and webinars which engage with operators on a whole host of issues - encouraging ideas, debate and solutions. We have been pleased with the initial results of these initiatives, which look positive, and we expect this work to continue and grow in the coming year. We will also be evaluating the impact of these initiatives to ensure they are resulting in standards be raised for consumers.
I am in no doubt that there is much more to do to make gambling in Great Britain fairer and safer and we all have a part to play in achieving that. Our enforcement work is a key part of our work at the Commission.
Neil McArthur Chief Executive
We have set out clear expectations for operators in relation to safer gambling and expect operators to actively cooperate with each other to mitigate and minimise harm, collaborating to accelerate progress and evidence impact.
We want a focus on ‘what works’, and first and foremost we expect operators to empower and protect consumers.
This area of regulatory oversight is broad, encompassing proper identification and engagement with those who may be at risk of or experiencing harms, ensuring terms and conditions are clear, fair and straightforward for consumers and do not target the vulnerable or self-excluded customers. Some examples are:
Social responsibility codes are built into the licence conditions and codes of practice (LCCP) and must be adhered to in the same way as licence conditions – as a requirement of holding a licence.
Our Gambling participation in 2018: behaviour, awareness and attitudes annual report revealed 30% of respondents thought gambling is fair and can be trusted and 79% were of the view there are too many opportunities to gamble nowadays. 71% considered gambling is dangerous for family life. In addition, the Gambling behaviour in Great Britain in 2016 report sets out there are around two million adults who may be experiencing at least moderate negative consequences from their gambling including 340,000 people who are classified as problem gamblers.
Our activity in the area of consumer protection continues to develop at pace in a number of work areas. As we set out in our Business plan 2019 to 2020, we will continue to push the industry to raise its consumer protection standards and demonstrate they know their customers and use what they know to protect them. We will support them by sharing best practice and encouraging collaboration through a programme of workshops, interactive events and partnership working.
In April 2019 we launched the new National Strategy to Reduce Gambling Harms. This three-year strategy will drive and coordinate work to bring a lasting impact on reducing gambling harms. For the first time health bodies, charities, regulators and businesses will come together in partnership to effectively tackle the issue – with the Commission calling for action and combined efforts to deliver the two strategic priority areas of prevention and education and treatment and support. As part of the new strategy, we will continue to take a firm regulatory enforcement approach while also further improving gambling harms research and evaluation, so there is widespread adoption of what works.
We have previously published guidance for the industry on customer interaction in online gambling. This is essential reading for operators, helping them identify people who may be experiencing or are at risk of developing problems with their gambling, and ensuring their systems are robust enough. Operators should use this guidance to look at their own policies and procedures. They must think about whether they meet our expectations or if more needs to be done.
We have also discovered repeated examples of customers being allowed to gamble significant sums of money in short time frames, way beyond their personal affordability, and without any intervention from the operator. These problems can be particularly acute over weekends and during the night. This issue of affordability is addressed further in the section below on this topic, which is relevant for both customer interaction and AML purposes.
There are signs of progress and pockets of developing good practice and collaboration. But much more needs to be done and shared across sectors to ensure the welfare of customers receives the commitment it requires.
We have taken regulatory action against a number of licensees who have failed to meet the customer interaction requirements to detect customers who are or may be problem gamblers. Key public statements were made following licence reviews in the following notable cases:
A casino operator who had onboarded a VIP from its land-based operations to its online:
A bookmaker who had a long-term relationship with a customer failed to follow customer interaction codes when that customer showed signs of experiencing serious harms from gambling and spent £34,000 through debit cards on B2 gaming machines in one betting shop, of which £11,250 was stolen. These failings flowed from the following flaws in its policies and procedures:
An online operator running a betting exchange failed to identify and interact with customers showing signs of problem gambling on numerous occasions. Any operator who offers customers the opportunity to bet on an exchange is liable in respect of both anti-money laundering (AML) and social responsibility provisions for all money through the exchange. Similar customer interaction failings were identified in its online and retail environments.
You should be asking yourself the following key questions with regards to customer interaction and identifying problem gamblers:
Do you have policies and procedures in place to identify customers who may be experiencing or at risk of developing problems with their gambling? Have you allocated sufficient resources to be able to interact with customers early and effectively when you have concerns?
Are you curious about your customers? Do you monitor customer activity?
Do you record interactions and use this information to aid your decision making about customers?
Do you track customers across your different platforms and do enough to spot multiple customer accounts?
Do you have systems in place to identify potential problem gamblers? Do these include appropriate and realistic trigger points for when the usual pattern of gambling becomes unusual (these should not just be financial)? How do you protect new or unknown customers (where a pattern of play cannot yet be established)?
Will your processes keep pace with increased demand? Will your growth or any merger affect your ability to monitor customers?
How are you evaluating these measures and procedures to ensure they are effective and how do you plan to make improvements over time?
Are your staff sufficiently trained to spot gamblers who might be experiencing harm and know how to report concerns? Are there clear procedures once a concern has been raised? Are there processes in place for weekends and late nights?
Where concerns arise, are you able to intervene early and engage with a customer?
Do your customer interaction policies and procedures also cover VIP customers?
Are you alert to the particular risk these customers bring? Are commercial considerations overriding customer protections?
Have you considered how you will meet the revised LCCP requirements for customer interaction? Have you reviewed your own processes against the guidance, and considered changes you need to make to meet the requirements from October 2019?
Work to ensure gambling stays free from crime and the proceeds of criminal finance remains a major area of concern.
We expect licensees to comply fully with the terms of their licence as relevant to anti-money laundering (AML) and counter terrorist financing (CTF) and pay close regard to the various guidance documents we issue. We provide regular updates on AML and CTF matters on our website.
Licensees should be aware of the following key updates over the past year:
We took enforcement action against several operators with regards to AML failings. Notable cases included:
During the last couple of years we have undertaken significant substantial assessments in the online gambling sector.
Compliance activity and enforcement cases revealed again and again that operators’ AML policies, procedures and controls are not fit for purpose. There has been the incorrect perception that all gambling regulators’ expectations are identical in addition to a failure to digest our guidance and implement the legislative requirements applicable to Great Britain. This must change, for these are not just regulatory matters but breaches of UK law. Those failing to learn these lessons will face further draconian action.
We have encountered issues and an over reliance on thresholds integrated into operating systems, designed to trigger referrals to specialist teams. Whilst conceptually these seem logical, they are far too often based on internal capacity and commercial considerations, not the risk profile and true affordability of their customers. Operators have then failed to intervene as gambling becomes out of control both in short bursts or over time, and allowed criminal funds to be deposited into accounts.
We have provided additional information in this year’s report to allow operators to reflect on their approach to thresholds and the issue of affordability.
We continue to see positive examples where some operators have more closely integrated their VIP management teams with their AML and social responsibility management teams, and encourage other operators to consider embedding this alignment into their existing practices.
We have also been encouraged by significant investment by certain operators in systems and techniques to profile customers. AML is an area where collaboration and evaluation of what works between operators can reap benefit for themselves and consumers.
Levels of staff training continues to be a concern with repeated instances of operators failing to provide relevant staff, including money laundering reporting officers, with regular training in how to recognise and deal with transactions and other activities which may relate to money laundering or terrorist financing.
We are also concerned by the frequent disconnect between operators’ money laundering and terrorist financing risk assessments; policies, procedures and controls; customer risk profiling; customer due diligence and ongoing monitoring; and enhanced customer due diligence and enhanced ongoing monitoring. For many operators this has become a tick-box exercise, without due consideration for their importance in the risk-based approach.
We have continued to impose increasingly tough financial penalties (or payments in lieu of financial penalties) in cases where there have been major AML failings in order to send a clear message to the industry.
This year we investigated a number of online casino operators who were found to have breached conditions of their licences in respect of AML and failing to comply with social responsibility codes of practice. This resulted in financial penalties being imposed alongside a warning and additional conditions to their licences.
Our investigations demonstrated repeated failings with AML policies, risk assessments and adherence to Money Laundering Regulations because operators did not:
The investigations revealed the lack of adherence to specific licence condition attached to the licence on 1 November 2014 and Licence Condition 12.1.2.1 - Anti money laundering measures for operators based in foreign jurisdictions. All online licensees are urged to revisit and digest these requirements.
During the year we published advice to operators through public statements. You should consider the following to ensure you are complying with the terms of your licence:
Have you allocated sufficient resources to AML compliance?
Have you ensured you have clear, up-to-date, and fit for purpose AML policies, procedures and controls available to all who require guidance?
Have you ensured your policies, procedures and controls have been informed by our guidance on AML? Are you assuming if you comply with the AML requirements of another regulator you are compliant with the Commission’s requirements?
Is your money laundering and terrorist financing risk assessment appropriate to your business? Have you taken into account the Commission’s Money Laundering and Terrorist Financing Risk Assessment, and the high-risk factors detailed in our guidance?
Are your policies, procedures and controls informed by the risks identified in your money laundering and terrorist financing risk assessment? Are they revised when the risks change?
Are your customer risk profiles informed by your money laundering and terrorist financing risk assessment? Are you placing an over-reliance on monetary thresholds as risk triggers and ignoring other risk factors?
Is the level of customer due diligence you conduct on particular customers informed by their risk profile? Do you scrutinise transactions to ensure they are consistent with the customer’s risk profile?
Have you ensured staff have, and continue to receive, adequate training on AML matters, including how to recognise and deal with transactions and other activities which may relate to money laundering or terrorist financing?
Are you supporting your nominated officers with the appropriate resources and training and do they have the authority to operate objectively and independently?
Are your systems and controls appropriate for your business?
Do you regularly assess the adequacy of your systems and controls and their effectiveness in mitigating the identified money laundering and terrorist financing risks?
Do you know your customer (KYC)? Are you gaining a holistic picture of the customer’s source of funds, particularly in relation to VIP customers? Are you critically assessing assurances you receive as to their source of funds?
Are you requiring customers to provide their occupation upon registration and then profiling their income for affordability?
Are you making records of customer interactions and transactions where necessary?
Is your approach governed by risk? Once an alert has been raised, do you have in place procedures to ensure the case is properly reviewed in a timely manner? Will decisions be appropriately recorded?
Are you confident commercial considerations do not outweigh your adherence to the terms of your licence?
Is risk being ‘owned’ at an appropriately senior level within your organisation?
During the year, our compliance and enforcement activity on this topic has resulted in standards improving, although operators still need to do more to ensure that their marketing communications are transparent and socially responsible.
LCCP requires operators to undertake marketing of gambling products in a socially responsible way and abide by any relevant provision of the Committee of Advertising Practice (CAP) code and the Broadcast Committee of Advertising Practice (BCAP) code (the UK Advertising Codes). We are concerned that some operators continue to advertise in a non-compliant manner which has led us to take enforcement action against an operator for misleading marketing practices.
We have worked closely with our regulatory partners, such as the Advertising Standards Authority (ASA) (opens in new tab) and the Competition and Markets Authority (CMA) (opens in new tab) to ensure marketing promotions do not mislead consumers. In 2018, the CMA published the outcome of its enforcement action against several operators in relation to online promotions. This highlighted that operators could be breaking consumer law when advertisements of bonus promotion fail to include prominently significant conditions and when related terms and conditions are unclear. We made it clear that we expect all operators to act to ensure their marketing material complies with the principles set out by the CMA, and undertook compliance activity to test how these changes were being made.
In October 2018, we introduced changes to LCCP to strengthen requirements in key areas. We elevated compliance with the UK Advertising Codes to a social responsibility code, meaning that operators that breached any aspect of the Codes could be subject to the full range of our regulatory powers, including financial penalties. We made clear in our requirements that the marketing of offers is transparent and does not mislead consumers, and added a new requirement to ensure that operators do not send direct electronic marketing without consent from consumers. We also introduced changes to clarify our position that operators are responsible for the actions of their third parties, including marketing affiliates.
We have concerns that operators are not taking sufficient care with the imagery and words used in adverts for gambling products to ensure that they are not likely to appeal to children. In collaboration with the ASA, we highlighted to operators and UK professional football leagues that they must make sure gambling adverts or sponsorship links do not appear on football website pages that are targeted at children. For example, the junior sections of the club’s website.
We urge operators to have regard to the recently published ASA/CAP guidance to ensure marketing campaigns are socially responsible and to better understand how the rules apply in practice:
We identified that LeoVegas or its affiliates published 41 website advertisements between April 2017 and January 2018, and of these:
This does not comply with the requirements in social responsibility code provision 5.1.7(2) and 5.1.7(2)(a) which states:
'licensees must abide by any relevant provision of the CAP (UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (CAP Code)) or BCAP (UK Code of Broadcast Advertising (BCAP Code)) code, as the case may be, which relates to ‘free bet’, ‘bonus’ or similar offers and in that regard follow the CAP and BCAP ‘Guidance on the rules for gambling advertisements.'
In particular that:
Further, social responsibility code provision 1.1.2(1)(a) states:
'licensees must take responsibility for third parties with whom they contract for the provision of any aspect of the licensee’s business related to the licensed activities and ensure that the terms on which they contract with such third parties:
These instances came despite:
LeoVegas acknowledged the breaches of these requirements and has implemented changes and improvements to processes and procedures to address these breaches. These include:
This case was resolved through a Regulatory settlement, which also included issues relating to their management of self-excluded customers. Leo Vegas made a payment in lieu of a financial penalty of £600,000.
Read the article relating to LeoVegas' penalty in full.
We encourage you to consider the following:
Do your marketing and advertising materials comply with the CAP and BCAP codes, and Licence conditions and codes or practice? If in doubt, have you made use of CAP’s copy advice team? Do you keep up to date with CAP and BCAP guidance, published on the ASA website, on the standards that you have to meet to ensure they comply with the rules?
Are your advertisements clear and fair? Do your marketing communications include significant limitations and qualifications consumers should be aware of?
Are you confident you have control over your marketing materials once you have engaged marketing affiliates? Have you ensured your contractual terms with affiliates are robust? Are you conducting regular audits of your affiliates’ activity against your compliance policy?
Are you allocating sufficient resources to ensuring your marketing and advertising is compliant?
Is responsibility for marketing and advertising being owned at an appropriate level within your organisation?
A key part of our enforcement work is the opening of criminal investigations and the use of criminal investigatory powers where we have concerns offences are being committed under the Gambling Act 2005 (opens in new tab). We have a statutory remit to keep crime out of gambling.
We take an incremental approach to suspected criminal activities. Where we suspect individuals or companies are illegally interacting with UK consumers our initial action is to issue cease and desist demands. Should these not be complied with, we will escalate matters which may lead to the opening of a formal criminal investigation. Once a criminal investigation has been opened, we have a broad range of investigatory powers available to us.
For those online, unlicensed operators who continue to engage with UK customers and do not adhere to our cease and desist notices, we use disruption techniques where appropriate. Our methods have included utilising our relationships with web hosts, payment providers and social media sites, to help prevent unlicensed operators interacting with UK consumers.
We have tackled 31 instances of remote unlicensed operators this year, a decline on previous years.
We are targeting a significant volume of substantial illegal gambling offerings via social media and are engaging with those platforms and payment providers to disrupt activity. There continues to be increased volumes of work addressing unlicensed lotteries promoted online.
We take seriously attempts to offer gambling to children and continue to disrupt those who offer illegal products such as skins gaming to UK consumers and young people. Escalated and expedited enforcement action is taken where cease and desist letters do not result in the closure of the website and social media pages.
We continue to investigate allegations of cheating under s.42 of the Gambling Act and work closely with sports governing bodies and media production companies in tackling this type of crime.
Additionally, we have investigated illegal bookmaking both at racecourses and within pubs working with the Police and Local Authorities. We have tackled the illegal supply of gaming machines and unlicensed lottery promotion.
In recent years our Enforcement team has reviewed numerous cases where individuals have demonstrated gambling-related harm and yet have been able to continue to gamble without effective engagement. Some of these individuals have funded their gambling activity through the misappropriation of monies from businesses, the taking out of unaffordable loans and misappropriating the funds from vulnerable people. Common to all these cases has been the ineffective controls framework used by the operators to identify and manage the risk.
Open source data exists which can help operators assess affordability for its GB customer base and improve its risk assessment and customer interventions. According to the Office for National Statistics Annual Survey of Hours and Earning: 2017 provisional and 2016 revised results:
Based on the above, 50% of the full-time employees in the UK receive less than £29,000 gross earning per year and 50% of the full-time managers, directors and senior officials in the UK receive less than £43,000 gross earnings. These figures omit income tax, national insurance and cost of living, for example but not limited to, mortgage payments or rent, mobile phone contracts, travel costs, food and utility bills.
A YouGov1 survey asked a nationally representative sample “Approximately how much do you PERSONALLY have available to spend each month as 'discretionary income', that is to say money left over after deducting taxes (including council tax) as well as expenditure on accommodation, utilities and food?”. Data was collected over a 52 week period from June 2018 to June 2019. All panellists are GB 18+. A split of the results by age is set out:
| Amount of monthly personal disposal income | 18 to 24 | 25 to 34 | 35 to 44 | 45 to 54 | 55 or over |
|---|---|---|---|---|---|
| Nothing | 7% | 6% | 7% | 9% | 6% |
| Less than £125 | 24% | 18% | 21% | 23% | 21% |
| £125 to £249 | 15% | 18% | 17% | 16% | 16% |
| £250 to £499 | 13% | 19% | 17% | 16% | 14% |
| £500 to £749 | 6% | 10% | 9% | 8% | 7% |
| £750 to £999 | 4% | 6% | 5% | 4% | 4% |
| £1,000 to £1,249 | 2% | 4% | 4% | 3% | 3% |
| £1,250 to £1,449 | 1% | 2% | 2% | 1% | 1% |
| £1500 and over | 2% | 3% | 3% | 3% | 4% |
For each age group, the data suggests that the GB population have disposable income per month from a figure less than £125 up to £499. This is equivalent to less than £1,500 per year and £6,000 per year. However, even these disposable income figures do not take into consideration unavoidable monthly costs or annual costs such as transport, fuel, monthly contractual payments (mobile phones, cars, life insurance etc), vehicle maintenance (service, repairs and MOT), clothing and personal care.
The disposable income data identifies clear benchmarks that should drive Social Responsibility (SR) triggers which will help to identify gambling-related harm by considering affordability. SR triggers should be set at a level so that most of the customer base is monitored based on the open source information.
To date we have seen nothing to indicate that gamblers have more disposable income than the general population and most people would consider it harmful if they were spending all their disposable income gambling. Benchmark triggers should be a starting point for engaging with customers and are not intended to definitively demonstrate a customer is suffering from gambling related harm – but they can help identify instances when an operator needs to understand more about a customer, their play and affordability.
Without adopting a framework based on such data, operators are at risk of not understanding whether customers are spending an affordable amount or whether the money is from a legitimate source.
Some of the casework has revealed operators omitting from their customer monitoring monies withdrawn and then apparently re-deposited, believing that no checks are required to mitigate any SR or Money Laundering risks. We have observed that this activity has been linked to SR issues where an individual is misappropriating monies and the monies re-deposited are fresh criminal spend. Operators should consider this and obtain evidence when appropriate to satisfy themselves that this is not the case.
We recognise that not all business models are the same and that operators have customers with different wealth and disposable incomes. But we do expect that the operator should be able to evidence this and have developed a framework that fully reflects and incorporates the diversity of its customers base.
As an example, we have observed operators attempting to assess affordability for wealthy customers by obtaining financial statements from Companies House and/or looking at property ownership. The subsequent customer triggers were then set at a level equal to the drawings from the companies or the net assets of the company and the value of the property combined. Operators applying this approach frequently fail to identify indicators of problem gambling.
In the examples some included financial statements, around which we make the following observations:
If an operator is going to set specific triggers for a customer base not representative of the general public, various documents sources should be relied upon, but they must contain sufficient information to substantiate the trigger level set.
In conclusion, we would recommend that operators revisit their framework on triggers and consider their customer base and their disposable income levels as a starting point for deciding benchmark triggers. This would help ensure vulnerable customers are identified as early as possible and interacted with appropriately.
1 The data was taken from YouGov Profiles, and collected from a National Representative sample of 127,642 panellists. All panellists were adults aged 18+ within the GB population. The question was asked between June 2018 to June 2019
This section of the report summarises our compliance activity during the year. Drawing on good practice we have identified during assessments and areas requiring improvement, we have composed a Compliance Health Check for operators to use.
This is a complete assessment of the operator’s business including its governance, how it manages risk, audit and compliance as well as a comprehensive look at the operator’s approach to safer gambling and AML.
Sometimes we undertake an examination of a specific area of one or more operators’ business.
Where we identify emerging themes, we will select a group of operators and conduct a thematic assessment with them.
These are assessments of operators’ information systems controls.
Every year we require the largest operators to submit a reflective self-assessment of how well they consider they are managing the risks to compliance with the LCCP and Licensing Objectives. From these we identify good practice and areas for improvement and share these with the other operators. We also use assurance statements to prioritise our assessment work.
We bring together a number of operators of similar size to provide updates, share good practice and provide advice on compliance.
In 2018 to 2019 we carried out almost 1,200 compliance assessments including corporate evaluations, targeted assessments and security audits. These assessments incorporated the largest land-based and online operators as well as many smaller operators.
We also delivered eight workshops. Four of these workshops were for the operators who submitted an assurance statement; we used the workshop to share the outcomes of our analysis of the assurance statement submissions, and to collaborate on identifying and sharing examples of good practice. The other four workshops were attended by 84 representatives from smaller operators. We used those workshops to provide updates on AML and safer gambling and to discuss common areas of non-compliance.
Our compliance team’s primary function is to check and assess whether operators are meeting the requirements of their licence. Where we judge that they are not, we can:
But our work is not solely about identifying failings. As part of our compliance work we also identify good practice, and by sharing this across the industry we support operators in raising their standards.
In 2018 we supported the Competition and Markets Authority (CMA)on an investigation into some operators’ commercial practices. The investigation focussed on bonus offers and customer terms and conditions.
The CMA investigated seven operators and where they judged that offers and terms and conditions appeared to contravene consumer protection law, they asked operators to sign undertakings.
As a consequence of this work, we introduced changes to our LCCP and to the guidance we provide on compliance with consumer protection law.
We have also amended the way we conduct assessments for online operators. When we review operator’s websites, we ask for test accounts to access information behind the sign-in page; we also ask operators to provide live website demonstrations to show us how they are compliant.
Our assessments are ongoing, but our initial findings were that operators were compliant in 52 out of 64 cases. Those that were not took swift action to amend their terms and conditions and their bonus offers.