Vivaro Limited Public Statement
Our public statements make reference to breaches of the Licence Conditions and Codes of Practice (LCCP) requirements which were in effect at the time of the breach. In some cases, the requirements have since been updated.
Operators are expected to consider the issues outlined as follows and review their own practices to identify and implement improvements in respect of the management of customers’ accounts.
Introduction
Licensed gambling operators have a legal duty to ensure gambling facilities are provided in compliance with the Gambling Act 2005 (the Act), the conditions of their licence, and in accordance with the licensing objectives, which are to:
- prevent gambling from being a source of crime or disorder, being associated with crime or disorder or being used to support crime
- ensure that gambling is conducted in a fair and open way
- protect children & other vulnerable people from being harmed or exploited by gambling.
Vivaro Limited Executive Summary
This investigation followed a compliance assessment carried out in April 2021 and resulted in the commencement of a section 116 regulatory review1 of Vivaro Limited (Vivaro), Combined Remote Operating Licence number: 000-044662-R-324273-017.
The regulatory review found failings in Vivaro’s processes which were aimed at preventing Money Laundering (ML) and safer gambling.
Between October 2020 and June 2021 Vivaro failed to comply with certain Licence Conditions and Codes of Practice (LCCP), specifically:
- paragraphs 2 and 3 of Licence condition 12.1.1, requiring the prevention of money laundering and terrorist financing
- Licence Condition 12.1.2 requiring operators based in foreign jurisdictions to comply with the Money Laundering, Terrorist Financing and Transfer of Funds (Information of the Payer) Regulations 2017
- paragraphs 1 and 2 of Social Responsibility Code Provision (SRCP) 3.4.1, requiring licensees to interact with customers in a way which minimises the risk of customers experiencing harms associated with gambling, and to take into account the Commission’s guidance on customer interaction.
In line with our Statement of principles for licensing and regulation, Vivaro will make payments in lieu of a penalty package of £337,631. A breakdown of the regulatory settlement is set out in the following sections.
The investigation, and our subsequent regulatory review, found:
- failings in Vivaro’s implementation of Anti-Money Laundering (AML) policies, procedures and controls
- deficiencies in its responsible gambling policies, procedures, controls and practices, including weaknesses in implementation.
Vivaro Limited Findings
We found that between October 2020 and June 2021, Vivaro had been in breach of the following licence conditions and Social Responsibility Code Provisions:
Breach of licence condition 12.1.1.2 and 12.1.1.3
Licence condition 12.1.1 (2) states that “Following completion of and having regard to the risk assessment, and any review of the assessment, licensees must ensure they have appropriate policies, procedures and controls to prevent money laundering and terrorist financing.”
Licence condition 12.1.1(3) states that “Licensees must ensure that such policies, procedures and controls are implemented effectively, kept under review, revised appropriately to ensure that they remain effective, and take into account any applicable learning or guidelines published by the Gambling Commission from time to time.”
Vivaro accepted it breached these licence conditions for the following reasons:
- customers were able to deposit a significant sum of money before ‘know your customer’ (KYC) checks were carried out
- Vivaro did not provide sufficient guidance within its policies or procedures as to how staff should verify Source Of Funds (SOF) and what supporting documents should be requested
- AML trigger levels were considered too high, based on the average level of customer spend, and were therefore not appropriate to effectively manage associated ML risk
- customers reviewed during the compliance assessment were subject to AML checks which were ineffective in establishing the SOF being used for gambling, bank statements were not scrutinised to identify other income and a reliance was placed on winnings from other operators. One Customer was able to deposit £14,850 within two months with insufficient SOF being established. It is the Commission's view that whilst some checks were conducted, these were not sufficient until the customer had met the ‘Very High AML Threshold’ set by the Licensee. It is the Commission's view that Vivaro were over reliant on the customer’s net gambling position. Another customer provided a bank statement showing a balance of over £270,000 said to be winnings from other betting account. Vivaro failed to sufficiently consider the risks associated with recycled winnings. In particular, no additional checks were undertaken to confirm the origin of the funds that had been used to gamble. Customers could be misappropriating funds and re-depositing fresh criminal spend
- the Licensee did not sufficiently consider the risks associated with funds a customer used to gamble that had originated from crypto currency. Crypto currency is considered high risk by Commission Officials and should be subject to further investigation.
The Commission’s review of the specific customers identified during the Compliance assessment found no evidence of criminal spend with the Licensee.
Breach of licence condition 12.1.2.1
Paragraph 1 of this condition has been in place since October 2016 and requires that:
“Licensees must comply with Parts 2 and 3 of the Money Laundering Regulations 2007 (UK Statutory Instrument No. 2157 of 2007) as amended by the Money Laundering (Amendment) Regulations 2007 (UK Statutory Instrument No. 3299 of 2007), or the equivalent requirements of any UK Statutory Instrument by which those regulations are amended or superseded insofar as they relate to casinos (the MLR) whether or not the MLR otherwise apply to their business”.
The Licensee accepts it breached this licence condition as the AML failings, set out above, constitute a breach of the 2017 Money Laundering Regulations, namely:
- Regulation 19 (1)(a) requires that the ‘relevant person’ must maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person
- Regulation 24 (a) imposes a relevant person must take appropriate measures to ensure that its relevant employees are made aware of the law relating to money laundering and terrorist financing, and to the requirements of data protection, which are relevant to the implementation of these Regulations; and regularly given training in how to recognise and deal with transactions and other activities or situations which may be related to money laundering or terrorist financing
- Regulation 28 (11)(a) requires ongoing monitoring of a business relationship which includes, where necessary, checking source of funds to ensure that the transactions are consistent with the relevant person’s knowledge of the customer, the customer’s business and risk profile.
Failure to comply with Social Responsibility Code Provision (SRCP) 3.4.1 Customer Interaction
Compliance with a SRCP is a condition of the licence by virtue of section 82(1) of the Act. SRCP 3.4.1 (amended from 31 October 2019) states:
“1 Licensees must interact with customers in a way which minimises the risk of customers experiencing harms associated with gambling. This must include:
a. identifying customers who may be at risk of or experiencing harms associated with gambling.
b. interacting with customers who may be at risk of or experiencing harms associated with gambling.
c. understanding the impact of the interaction on the customer, and the effectiveness of the Licensee’s actions and approach.
2 Licensees must take into account the Commission’s guidance on customer interaction.”.
Vivaro accepted it was not fully in compliance with SRCP 3.4.1 as:
- it had insufficient control in place to protect new customers, and to effectively consider high velocity spend and duration of play until the customer reached a ‘higher tier’ AML Trigger. In one example a customer was allowed to deposit and lose £4000 within a 4-day period
- it did not have sufficient resourcing of its KYC agents to manage requirements in respect of identifying customers at risk and undertake customer interactions. The automatic system suspension was in relation to financial triggers only; and that it did not sufficiently resource other risk factors
- it did not have sufficient resourcing or effective automatic blocking to manage requirements in respect of customer interactions. Commission Officials consider that the licensee would have been able to act more promptly and tailor interactions more appropriately (such as telephone calls) if there were sufficient staff resources
- there was a reliance from Vivaro on email interactions when customers hit safer gambling alerts. Whilst the emails were not automated, they were not sufficiently tailored to the customers’ individual circumstances
- there was a poor level of recording by Vivaro, as well as no evaluation of customer use and impact of responsible gambling tools and/or customer interactions for their effectiveness. One Customer with a salary of £5,000 a month, was able to deposit £20,000 between 09 September 2020 and 05 February 2021- this amounted to circa 80% of the customers salary and the Licensee did not sufficiently review this level of spend.
Vivaro Limited Regulatory Settlement
A regulatory settlement package of £337,631 has been agreed, which consists of the following elements:
- a payment in lieu of a financial penalty of £302,500 which will go to National Responsible Gambling Strategy project(s) to pay for research and treatment as determined appropriate to address the risk of harmful gambling
- divestment of £35,131
- the voluntary placing of additional condition on Vivaro’s’ operating licence under section 117(1)(b) of the Act, requiring the licensee to:
- undertake a third-party audit within 12 months of the conclusion of the review. The purpose of the audit is to examine whether the Licensee is effectively implementing its anti-money laundering and social responsibility policies, procedures and controls in accordance with its regulatory requirements
- provide the Commission with a copy of the Audit report within 5 working days of it being received by it.
- agree to the publication of a statement of facts by the Commission
- payment of £15,606.50 towards our investigative costs.
Conclusion
Our investigation found, and Vivaro accepts, that there were significant weaknesses in its systems relating to how it managed its customers for AML and social responsibility purposes.
In determining the appropriate outcome, we took the following factors into account:
- there were significant licence condition breaches for a sustained period of time. This impacted the licensing objectives, particularly preventing gambling from being used to support crime, and protecting vulnerable persons from being harmed or exploited by gambling
- proactive and timely action taken by Vivaro to address all the issues identified
- Vivaro being open and transparent from the outset of the investigation and fully co-operative throughout
- the nature of Vivaro’s business, including their financial resources.
Good Practice
Gambling operators should take account of the failings identified in this investigation to ensure industry learning. Operators should also consider the following questions:
- do you have formal processes in place to measure the effectiveness of your AML and safer gambling policies and procedures, and are findings adequately recorded?
- do you efficiently record all compliance decisions and are you able to demonstrate to the Commission, on request, evidence of ongoing assessment, evaluation and improvement?
- do lessons learned from public statements flow into your policy and processes?
- are your customer risk profiles informed by, or linked to, your money laundering and terrorist financing risk assessment?
- do you have a formalised process for analysing the effectiveness of customer interactions to ensure that reviews were adequately documented and consistent in their approach?
- do you log the types of behaviour which have triggered a customer interaction and keep sufficient records of interactions, along with decisions not to interact, especially the level of detail provided?
- have your staff received sufficient AML and SR training?