NetBet Enterprises Limited Public Statement
Our public statements make reference to breaches of the Licence Conditions and Codes of Practice (LCCP) requirements which were in effect at the time of the breach. In some cases, the requirements have since been updated.
Operators are expected to consider the issues outlined below and review their own practices to identify and implement improvements in respect of the management of customers’ accounts.
Introduction
Licensed gambling operators have a legal duty to ensure their gambling facilities are provided in compliance with the Gambling Act 2005 (opens in new tab)(the Act), the conditions of their licence and in accordance with the licensing objectives, which are to:
- prevent gambling from being a source of crime or disorder, being associated with crime or disorder or being used to support crime
- ensure that gambling is conducted in a fair, safe and open way
- protect children and other vulnerable people from being harmed or exploited by gambling.
Operators are expected to consider the issues outlined below and review their own practices to identify and implement improvements in respect of the management of customers’ accounts.
NetBet Enterprises Limited Executive Summary
A licence review under section 116 of the Act was commenced following a Compliance Assessment of the remote operating licence of NetBet Enterprises Limited trading as NetBet (“the Licensee”) (licence number 039170-R-319343-028)
The review found failings in the Licensee’s Anti-Money Laundering / Counter Terrorism Financing (AML/CTF) and Social Responsibility (SR) controls.
The Licensee failed to comply with the following Licence Conditions and Codes of Practice (LCCP):
- Paragraphs 1, 2 and 3 of Licence Condition (LC) 12.1.1 relating to the prevention of money laundering and terrorist financing
- Paragraphs 1, 2, 5 (a, b and c), 10, 11 and 14 of Social Responsibility Code Provision (SRCP) 3.4.3 relating to remote customer interaction.
- Paragraph 2 of Social Responsibility Code Provision 5.1.9 - Other marketing requirements
- LC 15.3.1 - General and regulatory returns
Following its own internal compliance workstreams and the Commission’s assessment, the licensee worked collaboratively to address concerns raised.
In line with our Statement of Principles for Licensing and regulation, the Licensee will make a payment in lieu of a financial penalty of £650,000. Details of this are set out under the heading Regulatory Settlement.
NetBet Enterprises Limited Findings
A Commission compliance assessment and subsequent regulatory review found:
Breach of paragraphs 1, 2 and 3 of Licence Condition 12.1.1
LCCP 12.1.1(1) requires:
"Licensees must conduct an assessment of the risks of their business being used for money laundering and terrorist financing. Such risk assessment must be appropriate and must be reviewed as necessary in the light of any changes of circumstances, including the introduction of new products or technology, new methods of payment by customers, changes in the customer demographic or any other material changes, and in any event reviewed at least annually."
We found that the Licensee’s risk assessment was not appropriate as it omitted some key risks. For example, the management of third-party business relationships, high stakes gambling and controls relating to third country nationals residing in the UK.
LCCP 12.1.1(2) requires:
"Following completion of and having regard to the risk assessment, and any review of the assessment, licensees must ensure they have appropriate policies, procedures and controls to prevent money laundering and terrorist financing."
We found that, between November 2023 and July 2024, the Licensee failed to ensure it had appropriate policies, procedures and controls to prevent money laundering and terrorist financing.
We found that the Licensee:
- appeared to be over-reliant on financial triggers; there were examples of customers being allowed to spend disproportionally to their net income
- the policies, procedures and controls did not detail how it ensures appropriate measures are taken when adopting new products, new business practices (including new delivery mechanisms) or new technology
- during the customer reviews undertaken at the Assessment, there were multiple examples of significant activity (for example, disproportionate spend) taking place where concerning behaviours were demonstrated by customers, however the customer remained low risk.
LCCP 12.1.1(3) requires:
"Licensees must ensure that such policies, procedures and controls are implemented effectively, kept under review, revised appropriately to ensure that they remain effective, and take into account any applicable learning or guidelines published by the Gambling Commission from time to time."
We found that, between November 2023 and July 2024, the Licensee failed to ensure its policies, procedures and controls to prevent money laundering and terrorist financing were implemented effectively.
As an example, a customer was not referred to the Money Laundering Reporting Officer (MLRO) and remained AML low risk despite depositing circa £2,000 within four active days, via an e-wallet (Apple pay), and working in a higher-risk occupation. A pay slip submitted later by the customer showed monthly net pay of circa £2,800, however, disproportionate spend was not considered when the customer deposited £1,650 within a two-hour period.
Breach of Licence Condition 15.3.1 - General and regulatory returns
Licence condition 15.3.1 requires:
"On request, licensees must provide the Commission with such information as the Commission may require, in such a form or manner as the Commission may from time-to-time specify, about the use made of facilities provided in accordance with this licence and the manner in which gambling authorised by this licence and the licensee’s business in relation to that gambling are carried on."
"In particular within 28 days of the end of each quarterly period or, for those only submitting annual returns, within 42 days of the end of each annual period, licensees must submit an accurate Regulatory Return to the Commission containing such information as the Commission may from time to time specify."
The Licensee submitted inaccurate information when filing their regulatory returns. Regulatory returns are important as we use the data provided to:
- ensure licensees are within the correct fee category
- to provide us with vital information to ensure we regulate effectively
- to publish industry statistics.
Failure to comply with paragraphs 1, 2, 5 (a, b and c) 10, 11 and 14 of SRCP 3.4.3
Compliance with a SRCP is a condition of the licence by virtue of section 82(1) of the Act.
We found that in various periods between September 2022 and July 20241 the Licensee failed to comply with the following requirements relating to remote customer interaction.
SRCP 3.4.3 paragraph 1 requires:
"Licensees must implement effective customer interaction systems and processes in a way which minimises the risk of customers experiencing harms associated with gambling. These systems and processes must embed the three elements of customer interaction – identify, act and evaluate – and which reflect that customer interaction is an ongoing process as explained in the Commission’s guidance (see paragraph 2)."
The Licensee had not always ensured that its policies, procedures and controls had been effectively implemented.
We found that the Licensee:
-
did not implement effective customer interaction systems and processes in a way which minimised the risk of customers experiencing harms associated with gambling because:
-
multiple indicators of harm were not identified in a timely manner and often were only identified once a manual review (if any) had taken place on the account. For example, the Licensee did not identify the following indicators of harm in a timely manner:
- overnight play
- velocity of deposits/ exhausting limits
- escalated gameplay
-
multiple indicators of harm were not identified in a timely manner and often were only identified once a manual review (if any) had taken place on the account. For example, the Licensee did not identify the following indicators of harm in a timely manner:
- despite concerning behaviour repeating on several occasions the Licensee did not appear to evaluate low-level interactions such as emails and pop-ups.
This resulted in customers not being interacted with in a timely manner. Officials note that low-level interventions were occurring, and systems have since been strengthened:
SRCP 3.4.3 paragraph 2 requires:
"Licensees must take into account the Commission’s guidance on customer interaction for remote operators as published and revised from time to time (‘the Guidance’)."
The Licensee did not sufficiently take into account the Commission’s guidance.
SRCP 3.4.3 paragraph 5 requires:
"Licensees must use a range of indicators relevant to their customer and the nature of the gambling facilities provided in order to identify harm or potential harm associated with gambling.
These must include:
- a. customer spend
- b. patterns of spend
- c. time spent gambling"
During the Compliance assessment and as part of the investigation we found that the Licensee was not compliant with paragraphs 5 (a) customer spend, 5 (b) patterns of spend and 5(c) time spent gambling.
We identified this issue from our customer reviews, as examples:
- a customer displayed a tendency to gamble throughout the early hours of the morning. In one session the customer started gambling at 03:32am and by 03:35 am on the same day, the customer had deposited and placed their whole balance of £1,500 on Poker. This behaviour continued with future sessions starting at 11:35 pm, 01:50am , 05:46am and 03:18am, with the customer depositing and staking their deposit limit. Despite this unusual behaviour the customer only received automated email and pop ups interactions after hitting other Safer Gambling (SG) alerts.
- a customer displayed concerning behaviour in that they routinely exhausted their monthly deposit limit within a few minutes. For example, they deposited £15,000 within 40 minutes in one session, then 4 weeks later £15,500 within 2 hours. Moreover, the customer was able to deposit £31,000 in a two-day period at the end of one month (£15,500) and the beginning of the next month (£15,500), because the limits set were per calendar month. Despite this concerning behaviour it was only identified as an indicator of harm once the customer’s account was manually reviewed.
SRCP 3.4.3 paragraph 10 requires:
"Licensees must prevent marketing and the take up of new bonus offers where strong indicators of harm, as defined within the licensee’s processes, have been identified."
During the Compliance assessment and as part of the investigation we found the Licensee’s SG Policy and Procedures did not show how the Licensee prevents marketing and the take up of new bonus offers where customers display strong indicators of harm, as defined within the Licensee’s processes.
SRCP 3.4.3 paragraph 11 requires:
"Licensees must ensure that strong indicators of harm, as defined within the licensee’s processes, are acted on in a timely manner by implementing automated processes. Where such automated processes are applied, the licensee must manually review their operation in each individual customer’s case and the licensee must allow the customer the opportunity to contest any automated decision which affects them."
We found during the Compliance assessment and as part of the investigation, that the Licensee’s SG policies were not adequate, as they did not contain an explicit reference to the procedure by which customers are informed of decisions made solely by automated means, or their right to contest such decisions.
SRCP 3.4.3 paragraph 14 requires:
"Licensees must take account of problem gambling rates for the relevant gambling activity as published by the Commission, in order to check whether the number of customer interactions is, at a minimum, in line with this level. For the avoidance of doubt, this provision is not intended to mandate the outcome of those customer interactions."
We found during the Compliance assessment that the Licensee’s SG policies were not adequate, as this requirement was not referenced.
Failure to comply with SRCP 3.2.11 - Remote SR code, paragraph 2b
SRCP 3.2.11 paragraph 2b requires
"Licensees must have and put into effect policies and procedures designed to prevent underage gambling and monitor the effectiveness of these.
Such procedures must include:
- warning potential customers that underage gambling is an offence"
Following a review of the Licensee’s website on 11 April 2024, Officials found that there was no warning. The Licensee immediately rectified this issue.
Failure to comply with paragraph 2 of SRCP 5.1.9 - Other marketing requirements
SRCP 5.1.9 paragraph 2 requires
"Licensees must ensure that all significant conditions which apply to marketing incentives are provided transparently and prominently to consumers. Licensees must present the significant conditions at the point of sale for any promotion, and on any advertising in any medium for that marketing incentive except where, in relation to the latter, limitations of space make this impossible. In such a case, information about the significant conditions must be included to the extent that it is possible to do so, the advertising must clearly indicate that significant conditions apply and where the advertisement is online, the significant conditions must be displayed in full no further than one click away."
We found that the Licensee’s £1 million Jackpot prize on its website did not appear to include the significant terms of the promotion, despite not being subject to space limitations, as mentioned in the Competition and Markets Authority (CMA) guideline.
Officials note that this was an isolated incident and that it was swiftly and comprehensively addressed once identified.
NetBet Enterprises Limited Regulatory settlement
This regulatory settlement consists of:
- a payment in lieu of a financial penalty of £650,000. The money will be directed to socially responsible purposes
- agreement to the publication of a statement of facts in relation to this case
- make an undertaking requiring an independent audit of the policies, procedures, and controls relevant to the issues identified during the Assessment and the Licence Review process, including the effectiveness of the current governance, risk management, and compliance arrangements
- payment towards the Commission’s costs of investigating the case.
In considering an appropriate resolution to this investigation, the Commission has had regard to the following aggravating and mitigating factors:
Aggravating factors
- the Commission has previously issued public statements regarding similar issues which it has observed in relation to other operators.
Mitigating factors
NetBet Enterprises Limited:
- swiftly put in place an action plan designed to remedy the failings and provided updates
- fully co-operated with the investigation and provided information by agreed deadlines
- accepted the failings at an appropriately early stage in the investigation.
Good practice
Gambling operators should take account of the failings identified in this investigation to ensure industry learning. Operators should consider the following questions and take remedial action where required:
- are your AML/CTF financial thresholds automated hard-stops? When a threshold is reached, do you act swiftly enough to review accounts and mitigate risks, or can customers continue to make significant transactions after they exceed the thresholds?
- would your safer gambling controls identify all the potential indicators of harm, as required by SRCP 3.4.3?
- do your AML and SG triggers operate on a calendar-month basis instead of rolling periods? If so, are you alert to the issues that may arise from this?
- can you demonstrate that you assess the impact of your customer interactions?
- do you review your website content regularly to ensure it is compliant with the LCCP?
Footnotes
1 Paragraphs 1 and 2 of SRCP 3.4.3 came into force in October 2023 and paragraph 10 came into force in February 2023, meaning in relation to these paragraphs, the Licensee only failed to comply during that period.