Football Pools Limited Public Statement
Our public statements make reference to breaches of the Licence Conditions and Codes of Practice (LCCP) requirements which were in effect at the time of the breach. In some cases, the requirements have since been updated.
Operators are expected to consider the issues outlined below and review their own practices to identify and implement improvements in respect of the management of customers’ accounts.
Introduction
Licensed gambling operators have a legal duty to ensure their gambling facilities are provided in compliance with the Gambling Act 2005 (opens in new tab)(the Act), the conditions of their licence and in accordance with the licensing objectives, which are to:
- prevent gambling from being a source of crime or disorder, being associated with crime or disorder or being used to support crime
- ensure that gambling is conducted in a fair, safe and open way
- protect children and other vulnerable people from being harmed or exploited by gambling.
Operators are expected to consider the issues outlined below and review their own practices to identify and implement improvements in respect of the management of customers’ accounts.
Football Pools Limited Executive Summary
A regulatory review under section 116 of the Act was commenced following a Compliance Assessment (the Assessment) of the remote Operating Licence of Football Pools Limited (the Licensee) (licence number 048272-R-326339-008).
The review found failings in the Licensee’s Anti-Money Laundering / Counter Terrorist Financing (AML/CTF) and Social Responsibility (SR) controls. The failings related to the Licensee’s online betting, as opposed to the non-remote Pool Betting.
The Licensee failed to comply with the following Licence Conditions and Codes of Practice (LCCP) between September 2022 and August 2023:
- paragraphs 2 and 3 of Licence Condition (LC) 12.1.1 which requires licensees to ensure they have appropriate policies, procedures and controls to prevent Money Laundering (ML) and Terrorist Financing (TF). The Licensee must also ensure that ML policies, procedures and controls are implemented effectively, kept under review, revised appropriately to ensure that they remain effective, and take into account any applicable learning or guidelines published by the Gambling Commission.
- paragraphs 1, 4, 5 and 8 of Social Responsibility Code Provision (SRCP) 3.4.3 relating to remote customer interaction.
In line with our Statement of Principles for Licensing and regulation, the Licensee will make a payment in lieu of a financial penalty of £375,000. Details of this are set out under the heading Regulatory Settlement.
Football Pools Limited Findings
The Assessment and subsequent regulatory review found the following:
Breach of Paragraphs 2 and 3 of Licence Condition 12.1.1
LCCP 12.1.1 (2) requires:
"Following completion of and having regard to the risk assessment, and any review of the assessment, Licensees must ensure they have appropriate policies, procedures and controls to prevent money laundering and terrorist financing."
LCCP 12.1.1(3) requires:
"Licensees must ensure that such policies, procedures and controls are implemented effectively, kept under review, revised appropriately to ensure that they remain effective, and take into account any applicable learning or guidelines published by the Gambling Commission from time to time."
The Licensee accepted that it breached these licence conditions for the following reasons:
- its AML policy was overly reliant on financial triggers to identify when customers present higher ML or TF risks
- processes in place at the time of the assessment did not automatically apply hard stops when AML thresholds were reached and were only applied when resulting manual reviews took place. The Licensee did not always consider customer risk in a timely manner; specifically considering whether the risks presented by the customer warranted the application of a hard stop, or whether the risks were perceived to be such that the customer should be prevented from depositing and gambling further until a proper risk assessment was undertaken and a decision made on whether the relationship should continue
- manual reviews did not always occur promptly, which meant that hard stops were not put in place in a timely manner, if at all
- officials noted that there were incidents of delays in the creation of customer risk profiles, incidents where risk profiles had not been created, and incidents where risk profiles were not completed for a significant period (on average 25 days after the financial trigger was hit).
Failure to comply with paragraphs 1, 4, 5 and 8 of SRCP 3.4.3
Compliance with a SRCP is a condition of the licence by virtue of section 82(1) of the Act.
SRCP 3.4.3 paragraph 1 requires:
"Licensees must implement effective customer interaction systems and processes in a way which minimises the risk of customers experiencing harms associated with gambling. These systems and processes must embed the three elements of customer interaction – identify, act and evaluate – and which reflect that customer interaction is an ongoing process as explained in the Commission’s guidance (see paragraph 2)."
The Licensee accepted that it was not fully in compliance with paragraph 1 SRCP 3.4.3, as:
- there were examples where customers were not identified for Safer Gambling (SG) interactions due to ineffective internal systems (system) it had in place. The system appeared to overly focus on financial triggers, some of which were set too high. There was no evidence of sufficient evaluation of individual customer interactions and the overall process for interactions. We would have expected the Licensee to have evaluated SG interactions and considered whether additional actions were required within a timely manner
- the system was ineffective at providing safer gambling messages to customers who had opted out of marketing, which led to delays in interacting with such customers who were exhibiting markers of potential harm
- the financial triggers alone, as detailed within the Licensee’s SG Policy and Customer Interaction policy, were not effective enough in identifying customers potentially at risk of harm. Officials noted examples showing customers who were able to spend prolonged periods gambling and spend at high levels in short periods of time and still not be identified for a SG interaction
- a number of SG risk profiles should have been completed at the time of reaching the financial trigger as per SG Policy and Customer Interaction policy. However, the profiles were not created immediately, and in most cases, they were created months after reaching the trigger. There was a large backlog of risk profiles still to be completed due to low staffing levels.
SRCP 3.4.3 paragraph 4 requires:
"Licensees must have in place effective systems and processes to monitor customer activity to identify harm or potential harm associated with gambling, from the point when an account is opened."
The Licensee accepted it was not fully in compliance with paragraph 4 SRCP 3.4.3, as:
- the Licensee was reliant on its system to monitor activity and identify harm or potential harm In addition, the process dictated that when a customer reached a financial trigger, they should receive an SG interaction. A number of SG risk profiles were not created by the Licensee immediately after a trigger was hit, in some cases this was not created until two months after the Financial Trigger was hit.
SRCP 3.4.3 paragraph 5 requires:
"Licensees must use a range of indicators relevant to their customer and the nature of the gambling facilities provided in order to identify harm or potential harm associated with gambling."
The Licensee accepted it was not fully in compliance with paragraph 5 SRCP 3.4.3, as:
- the Assessment identified that customers gambling at high velocity or placing large bets were not always identified for interaction early enough
- the system that was in place at the time was not sensitive enough to identify long periods of gambling as a potential marker of harm.
SRCP 3.4.3 paragraph 8 requires:
"Licensees must take appropriate action in a timely manner when they have identified the risk of harm."
The Licensee accepted it was not fully in compliance with paragraph 8 SRCP 3.4.3, as:
- it did not always take appropriate action in a timely manner when the risk of harm was identified
- the Licensee has a range of SG financial triggers in place to identify potential harm in relation to customer spend. Officials found that customers were not always interacted with after reaching these financial triggers. One customer deposited circa £4,100 in two weeks after signing up but was not identified for an SG interaction despite reaching a financial alert.
Football Pools Limited Regulatory Settlement
This regulatory settlement consists of:
- a payment of £375,000 in lieu of a financial penalty. The money will be directed to socially responsible purposes
- agreement to the publication of a statement of facts in relation to this case
- payment towards the Commission’s costs of investigating the case.
In considering an appropriate resolution to this investigation, the Commission has had regard to the following aggravating and mitigating factors:
Aggravating factors
- the failings were serious and potentially impacted on the licensing objectives
- breaches of AML requirements directly imperil the first licensing objective of ‘preventing gambling from being a source of crime or disorder’
- breaches of SRCP 3.4.3 directly imperil the third licensing objective of protecting vulnerable persons from being harmed or exploited by gambling
- the breach arose in circumstances that were similar to previous cases the Commission has dealt with which resulted in the publication of lessons learned for the wider industry'.
Mitigating factors
The Licensee:
- swiftly put in place an action plan designed to remedy the failings and provided updates
- fully co-operated with the investigation and provided information by agreed deadlines.
Good practice
Gambling operators should take account of the failings identified in this investigation to ensure industry learning. Operators should consider the following questions and take remedial action where required:
- do you have effective processes in place to test and assess whether your policies, procedures and controls are being effectively implemented by staff? Is this recorded and demonstrable?
- do you have set turnaround times for manual reviews, actions, processes, etc? Are these routinely met?
- are you fully scrutinising all customer information available to you in a timely manner, properly assessing and taking steps to mitigate potential ML/TF and SR risks?
- do you act quickly enough when customers display potential markers of harm? Do your procedures specify appropriate timescales for actions and interactions?
- if you deviate from your policies and procedures, are you able to justify this and do you fully document those decisions and the rationale?
- do you have a formalised process for analysing the effectiveness of customer interactions to ensure that reviews were adequately documented and consistent in their approach?
- do you log the types of behaviour which have triggered a customer interaction and keep sufficiently detailed records of interactions? Does this include decisions not to interact with a customer?